/Bucket-Flaws

Bucket Flaws ( S3 Bucket Mass Scanner ): A Simple Lightweight Script to Check for Common S3 Bucket Misconfigurations

Primary LanguageShell

Bucket Flaws (S3 Bucket Mass Scanner)

Bucket Flaws: A Simple Lightweight Script that can take a list of bucket names and check for Common S3 Bucket Misconfigurations

Image of BucketFlaws

This is a very small and light bash script that can take both a list of buckets as well a single bucket and perform some basic security checks.

Misconfigurations

1) Unauthenticated Bucket Access

  • Checks for Directory Listing
  • Tries to upload a file (upload.png)

2) Authenticated Bucket Access (This means being authenticated to any aws account)

Bucket Level Checks

  • Checks for Directory Listing
  • Checks for some interesting files/folders based on the keywords provided in the sensitive.txt
  • Tries to fetch the Bucket ACL
  • Tries to upload a file (bucket.png)
  • Tries to dump the whole bucket (optional -d flag)
  • Tries to modify the Bucket ACL (optional -p flag)

Object Level Checks

  • Tries to fetch object ACL
  • Tries to fetch object metadata
  • Tries to dump the object (optional)
  • Tries to modify the object ACL

Usage

Install Reqirements:

pip install -r requirements.txt

Usage: -u for single bucket -f for file containing the list of all the buckets -o for performing object level analysis -p for changing the bucket ACL if allowed -d for dumping the whole bucket if allowed -h for help

Eg:
./bucketflaws.sh -u bucketname
./bucketflaws.sh -f filepath

For performing object level checks as well:
./bucketflaws.sh -u bucketname -o

For modifying Bucket ACL if possible:
./bucketflaws.sh -u bucketname -o -p

Performs all the checks as well as tries to dump the whole bucket(Recommended way):
./bucketflaws.sh -u bucketname -o -p -d

Same as above but for a list of buckets:
./bucketflaws.sh -f filepath -o -p -d

For storing the output to a txt file:
./bucketflaws.sh -f filepath -o -p -d | tee output.txt && sed -i 's/\x1B[[0-9;]+[A-Za-z]//g' output.txt

Image of BucketFlaws -u

Image of BucketFlaws -f

Walkthrough

Bucket-Flaws

NOTE: For Authenticated Check you need to make sure you have configured your aws cli.

Refer this link for configuring AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html