goGetBucket - A Penetration Testing Tool To Enumerate And Analyse Amazon S3 Buckets Owned By A Domain

When performing a recon on a domain - understanding assets they own is very important. AWS S3 bucket permissions have been confused time and time again, and have allowed for the exposure of sensitive material.

What this tool does, is enumerate S3 bucket names using common patterns I have identified during my time bug hunting and pentesting. Permutations are supported on a root domain name using a custom wordlist. I highly recommend the one packaged within AltDNS.

The following information about every bucket found to exist will be returned:

• List Permission
• Write Permission
• Region the Bucket exists in
• If the bucket has all access disabled

Installation

go get -u github.com/glen-mac/goGetBucket

Usage
goGetBucket -m ~/tools/altdns/words.txt -d <domain> -o <output> -i <wordlist>

Usage of ./goGetBucket:
  -d string
        Supplied domain name (used with mutation flag)
  -f string
        Path to a testfile (default "/tmp/test.file")
  -i string
        Path to input wordlist to enumerate
  -k string
        Keyword list (used with mutation flag)
  -m string
        Path to mutation wordlist (requires domain flag)
  -o string
        Path to output file to store log
  -t int
        Number of concurrent threads (default 100)

Throughout my use of the tool, I have produced the best results when I feed in a list (-i) of subdomains for a root domain I am interested in. E.G:

www.domain.com
mail.domain.com
dev.domain.com

The test file (-f) is a file that the script will attempt to store in the bucket to test write permissions. So maybe store your contact information and a warning message if this is performed during a bounty?
The keyword list (-k) is concatenated with the root domain name (-d) and the domain without the TLD to permutate using the supplied permuation wordlist (-m).
Be sure not to increase the threads too high (-t) - as the AWS has API rate limiting that will kick in and start giving an undesired return code.

Download goGetBucket

Read more

1. Kik Hack Tools
2. What Is Hacking Tools
3. Hacking App
4. Hacker Search Tools
5. Hacking Tools Windows
6. Pentest Recon Tools
7. Hacker Tools Mac
8. Hacker Tools For Mac
9. Hacker Techniques Tools And Incident Handling
10. Hacker Tools For Ios
11. Tools 4 Hack
12. Github Hacking Tools
13. Hacking Tools For Mac
14. Hacker
15. Computer Hacker
16. Hackrf Tools
17. Black Hat Hacker Tools
18. Pentest Tools Apk
19. Hack Tools For Mac
20. Tools For Hacker
21. Hacker Hardware Tools
22. Hack Tool Apk
23. Game Hacking
24. Pentest Tools
25. Pentest Tools For Android
26. Hacker Search Tools
27. Top Pentest Tools
28. Pentest Automation Tools
29. Free Pentest Tools For Windows
30. Hack Rom Tools
31. Hack App
32. Pentest Tools For Android
33. Hacking Tools Windows 10
34. Hacker Tools For Pc
35. What Are Hacking Tools
36. Hacking Tools Name
37. Hacker Tools 2019
38. Hackers Toolbox
39. Usb Pentest Tools
40. Pentest Tools Download
41. Hacker Tools Apk Download
42. Pentest Tools Url Fuzzer
43. New Hacker Tools
44. Pentest Recon Tools
45. Hacker Tools Software
46. Pentest Tools Open Source
47. Hacking Apps
48. Install Pentest Tools Ubuntu
49. Pentest Tools Windows
50. Hacker Tools 2019
51. Pentest Tools
52. Pentest Reporting Tools
53. New Hack Tools
54. Hacker Tools
55. Hacker Tools Mac
56. Hacking Tools For Windows
57. Pentest Tools Find Subdomains
58. Pentest Tools For Ubuntu
59. Nsa Hack Tools
60. Hacking Tools Online
61. Pentest Tools Alternative
62. Pentest Tools List
63. What Are Hacking Tools
64. Hacker Hardware Tools
65. Hacking Tools 2019
66. Pentest Reporting Tools
67. Hack Tools
68. Hack Tools Download
69. Pentest Tools List
70. Hacking Tools
71. Nsa Hack Tools Download
72. Hacker Tool Kit
73. Hacker Tools Linux
74. Android Hack Tools Github
75. Hack Website Online Tool
76. Kik Hack Tools
77. Pentest Box Tools Download
78. Pentest Tools
79. Pentest Tools Port Scanner
80. Hacker Techniques Tools And Incident Handling
81. Hacker Tools
82. Pentest Tools For Windows
83. Hack Tool Apk
84. Pentest Tools Find Subdomains
85. Pentest Tools For Mac