• Stars
    star
    353
  • Rank 120,322 (Top 3 %)
  • Language
    PHP
  • License
    MIT License
  • Created over 7 years ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Find AWS S3 buckets and test their permissions.

s3-buckets-finder

PHP tool to brute force Amazon S3 bucket and test permissions.

php badge MIT license badge twitter badge


Description

This PHP tool searches for AWS S3 buckets using a given wordlist. When an existing bucket is found, the tool checks the permissions of the bucket: get ACL, put ACL, list, HTTP list, write

Requirements

Amazon S3:

apt-get install awscli
aws configure

Google Cloud:
https://cloud.google.com/storage/docs/gsutil_install

Install

git clone https://github.com/gwen001/s3-buckets-finder

Usage

Usage: php s3-buckets-bruteforcer.php [OPTIONS] --bucket <bucket>

Options:
	--bucket	single bucket name or listing file
	--detect-region	Amazon only, try to automatically detect the region of the bucket
	--force-recurse	even if the bucket doesn't exist, the max-depth option will be applied (use this option at your own risk)
	--glue		characters used as a separator when concatenate all elements, default are: none, dash, dot and underscore
	-h, --help	print this help
	--list		do no perform any test, simply list the generated permutations
	--max-depth	max depth of recursion, if a bucket is found, another level will be added (permutations are applied), default=1, ex:
				if <bucket> is found then test <bucket>-xxx
				if <bucket>-xxx is found then test <bucket>-xxx-yyy
	--no-color	disable colored output
	--perform	tests to perform, default=esglw
				e: test if exist (always performed)
				s: set ACL
				g: get ACL
				l: list (cli and http)
				w: write
	--permut	permutation can be tested, default=0
				0: no permutation
				1: if both provided prefix and suffix are permuted (prefix.<bucket>.suffix, suffix.<bucket>.prefix)
				2: permutation applied only on the bucket name (a.b.c, b.c.a, ...)
				3: each elements will be separately permuted, then glogal permutation
	--prefix	single prefix or listing file
	--provider	can be: amazon, google, digitalocean
	--region	Amazon only, set the region (overwrite the option detect-region), value can be:
				us-east-1 us-east-2 us-west-1 us-west-2
				ap-south-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2
				eu-central-1 eu-west-1 eu-west-2
				ca-central-1 sa-east-1
	--suffix	single suffix or listing file
	--thread	max threads, default=5
	-v,--verbosity	set verbosity, default=0
				0: everything
				1: do not display not found
				2: display only permissions success
				3: display only set ACL and write permission success

Examples:
	php s3-buckets-bruteforcer.php --bucket gwen001-test002
	php s3-buckets-bruteforcer.php --bucket listing.txt --no-color --verbosity 1
	php s3-buckets-bruteforcer.php --bucket listing1.txt --bucket listing2.txt --bucket listing3.txt --perform e --thread 10
	php s3-buckets-bruteforcer.php --bucket listing.txt --prefix prefix.txt --suffix suffix1.txt --suffix2.txt --perform esw --thread 10
	php s3-buckets-bruteforcer.php --bucket listing.txt --region us-east-2 --rlevel 3


Feel free to open an issue if you have any problem with the script.

More Repositories

1

pentest-tools

A collection of custom security tools for quick needs.
Python
2,971
star
2

github-search

A collection of tools to perform searches on GitHub.
Python
1,233
star
3

github-subdomains

Find subdomains on GitHub.
Go
663
star
4

cloudflare-origin-ip

Try to find the origin IP of a webapp protected by Cloudflare.
Python
258
star
5

BB-datas

Tools and datas related to Bug Bounty.
PHP
225
star
6

github-endpoints

Find endpoints on GitHub.
Go
184
star
7

offsectools_www

A vast collection of security tools and resources curated by the community.
HTML
177
star
8

DataExtractor

A Burp Suite extension to extract datas from source code while browsing.
Python
136
star
9

related-domains

Find related domains of a given domain.
Python
84
star
10

dnspy

Find subdomains and takeovers.
Python
83
star
11

vhost-brute

A PHP tool to brute force vhost configured on a server.
PHP
78
star
12

actarus

Actarus is a custom tool for bug bounty
HTML
76
star
13

bugbountytips

Webapp to search tips on Twitter through #bugbountytips
CSS
67
star
14

github-regexp

Basically a regexp over a GitHub search.
Go
61
star
15

gitlab-subdomains

Find subdomains on GitLab.
Go
60
star
16

myrecon.py

My recon script
Python
52
star
17

keyhacks.sh

Automation of tokens/api keys testing.
Shell
48
star
18

google-search

Returns results from Google search.
Python
43
star
19

bxss

Alternative to XSS Hunter for blind XSS.
PHP
40
star
20

BBstats

Bug Bounty statistics tool.
PHP
30
star
21

BBvuln

A listing of the most common vuln that you can link in your PoCs
25
star
22

testxss

PHP tool to test XSS
PHP
22
star
23

favicon-hashtrick

Python script implementing the favicon hash trick to find subdomains.
Python
22
star
24

detectify-cves

Find CVEs that don't have a Detectify modules.
Python
20
star
25

csp-analyzer

Analyze Content-Security-Policy header of a given URL.
Python
15
star
26

gitgrep

Webapp to perform regexp search over GitHub search.
PHP
14
star
27

dnsexpire

Test domain expiration dates.
PHP
13
star
28

apk-analyzer

Analyze an APK archive.
Python
13
star
29

extract-endpoints

Extract endpoints from source files.
PHP
11
star
30

urlgrabber

PHP tool to grab urls of a specific site.
PHP
11
star
31

gitpillage

Extract data from a .git directory.
Python
10
star
32

shotTheWorld

PHP tool that takes screenshots of a given ips/ports combo list and then try to guess the service.
PHP
9
star
33

graphql-introspection-analyzer

Graphql introspection query analyzer.
Python
8
star
34

php-stegano-lsb

Hide file using Least Significant bits method.
PHP
7
star
35

testidor

PHP tool to test IDOR
PHP
6
star
36

dotfiles

me dotfiles
Shell
6
star
37

3rdparty-services

PHP tool to test 3rd party service validity
PHP
6
star
38

gwen001

6
star
39

autoknoxss

Custom PHP tool to automate calls to KNOXSS
PHP
6
star
40

act_custom

Custom scripts for Actarus
PHP
5
star
41

testcrlf

PHP tool to test CRLF
PHP
5
star
42

icmp-send-file

send file with ping
Shell
4
star
43

ipsites

PHP tool to find websites hosted by a given ip
PHP
4
star
44

thegarden

Vulnerable web application made with Laravel.
JavaScript
4
star
45

testcors

PHP tool to test CORS
PHP
3
star
46

testionion

PHP script to find onion websites
PHP
3
star
47

10degres.net_jenkins

http://10degres.net
HTML
3
star
48

testcsrf

PHP tool to test CSRF
PHP
3
star
49

ultimate-open-redirect

PHP tool to test open redirect
PHP
3
star
50

testssrf

PHP tool to test SSRF
PHP
3
star
51

MyPhpDirb

GoBuster like written in PHP
PHP
2
star
52

setricks

Small search engine tool usefull to find the position of a given website
PHP
2
star
53

gwen001.github.io

Silence is golden.
Go
2
star
54

testgo

my golang test
Go
1
star
55

poc_subto

JavaScript
1
star
56

github-stargizer

View stars evolution of GitHub repositories.
PHP
1
star