goGetBucket - A Penetration Testing Tool To Enumerate And Analyse Amazon S3 Buckets Owned By A Domain

When performing a recon on a domain - understanding assets they own is very important. AWS S3 bucket permissions have been confused time and time again, and have allowed for the exposure of sensitive material.

What this tool does, is enumerate S3 bucket names using common patterns I have identified during my time bug hunting and pentesting. Permutations are supported on a root domain name using a custom wordlist. I highly recommend the one packaged within AltDNS.

The following information about every bucket found to exist will be returned:

• List Permission
• Write Permission
• Region the Bucket exists in
• If the bucket has all access disabled

Installation

go get -u github.com/glen-mac/goGetBucket

Usage
goGetBucket -m ~/tools/altdns/words.txt -d <domain> -o <output> -i <wordlist>

Usage of ./goGetBucket:
  -d string
        Supplied domain name (used with mutation flag)
  -f string
        Path to a testfile (default "/tmp/test.file")
  -i string
        Path to input wordlist to enumerate
  -k string
        Keyword list (used with mutation flag)
  -m string
        Path to mutation wordlist (requires domain flag)
  -o string
        Path to output file to store log
  -t int
        Number of concurrent threads (default 100)

Throughout my use of the tool, I have produced the best results when I feed in a list (-i) of subdomains for a root domain I am interested in. E.G:

www.domain.com
mail.domain.com
dev.domain.com

The test file (-f) is a file that the script will attempt to store in the bucket to test write permissions. So maybe store your contact information and a warning message if this is performed during a bounty?
The keyword list (-k) is concatenated with the root domain name (-d) and the domain without the TLD to permutate using the supplied permuation wordlist (-m).
Be sure not to increase the threads too high (-t) - as the AWS has API rate limiting that will kick in and start giving an undesired return code.

Download goGetBucket

Related word

1. Hacker Tools For Windows
2. Hack Tools Github
3. Easy Hack Tools
4. Hack Tools Github
5. Hacking Tools Kit
6. Hack Apps
7. Hacking Tools And Software
8. Pentest Box Tools Download
9. Hacker Techniques Tools And Incident Handling
10. Hacker Tool Kit
11. Hacker Tools List
12. Pentest Tools Online
13. Hacking Tools Hardware
14. New Hacker Tools
15. Hacker Tools Free
16. Pentest Tools For Windows
17. Pentest Automation Tools
18. Growth Hacker Tools
19. Pentest Tools Framework
20. Pentest Tools Tcp Port Scanner
21. Pentest Tools Download
22. Usb Pentest Tools
23. Wifi Hacker Tools For Windows
24. Hack Tool Apk No Root
25. Hack Tool Apk
26. Best Pentesting Tools 2018
27. Hacker Security Tools
28. What Is Hacking Tools
29. Hacker Hardware Tools
30. Hacker Tools For Mac
31. Pentest Tools Subdomain
32. Nsa Hack Tools
33. Hacking Tools And Software
34. Pentest Tools Free
35. Hacking Tools 2019
36. Hacking Tools 2019
37. Pentest Tools Find Subdomains
38. Hacking App
39. Nsa Hack Tools
40. Hack Tools Mac
41. Hacker Tools 2020
42. Hacking Tools And Software
43. Easy Hack Tools
44. Hack Tools Pc
45. Hacking Tools 2020
46. Hack Tools Download
47. Hack Tools 2019
48. Hack Tools Download
49. Pentest Tools Alternative
50. Top Pentest Tools
51. Hack Tools 2019
52. Pentest Tools Url Fuzzer
53. Hacker Techniques Tools And Incident Handling
54. Bluetooth Hacking Tools Kali
55. Hacker Tools Linux
56. New Hacker Tools
57. Pentest Tools Website Vulnerability
58. Hacking Apps
59. Hack Website Online Tool
60. Bluetooth Hacking Tools Kali
61. Hacker Security Tools
62. Hack Tools Online
63. Hack Tools For Games
64. Hacking Tools Mac
65. Hacking Tools 2019
66. Hacking Tools And Software
67. Hack Website Online Tool
68. Hacking Tools Windows 10
69. How To Make Hacking Tools