AWS-S3
Last updated
Last updated
A bucket is typically considered “public” if any user can list the contents of the bucket, and “private” if the bucket's contents can only be listed or written by certain S3 users. This is important to understand and emphasize. A public bucket will list all of its files and directories to an any user that asks.
It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket. And although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists (ACLs). Amazon provides information on managing access controls for buckets . Furthermore, Amazon helps their users by publishing a best practices document on . The default configuration of an S3 bucket is private.
Learn about AWS-S3 misconfiguration here: and (Most of the information here has been take from those resources)
US Standard =
Ireland =
Northern California =
Singapore =
Tokyo =
Prerequisites, at least you need awscli
You can get your credential here but you need an aws account, free tier account :
Alternatively you can use environment variables instead of creating a profile.
Different methods to find when a webpage is using AWS to storage some resources:
Using wappalyzer browser plugin
Using BURP (spidering the web) or by manually navigating through the page all resources loaded will be save in the History.
Check for resources in domains like:
Notice that a domain could be hiding some of this URLs for example resources.domain.com --> bucket.s3.amazonaws.com
You can get the region of a bucket with a dig and nslookup:
Check that the resolved domain have the word "website".
You can access the static website going to: flaws.cloud.s3-website-us-west-2.amazonaws.com
or you can access the bucket visiting: flaws.cloud.s3-us-west-2.amazonaws.com
If you tries to access a bucket but in the domain name you specifies another region (for example the bucket is in bucket.s3.amazonaws.com but you try to access bucket.s3-website-us-west-2.amazonaws.com you will be redirected to the correct location.
To test the openness of the bucket a user can just enter the URL in their web browser. A private bucket will respond with "Access Denied". A public bucket will list the first 1,000 objects that have been stored.
Open to everyone:
Private:
You can also check this with the aws tool:
If the bucket doesn't have a domain name, when trying to enumerate it, only put the bucket name and not the hole AWSs3 domain. Example: s3://<BUCKETNAME>
If you find some private AWS keys, you can create a profile using those:
Notice that if you find a users credentials in the meta-data folder, you will need to add the aws_session_token to the profile.
And the check to which buckets this profile is related to (may or may not have access to them):
Check the UserId, Account number and UserName doing:
To get information about a policy you first need the DefaultVersionId:
Now, you can see the policy:
This means that you can access GET arn:aws:apigateway:us-west-2::/restapis/*
Now it's time to find out possible lambda functions to execute:
A lambda function called "Level6" is available. Lets find out how to call it:
Now, that you know the name and the ID you can get the Name:
Notice that **AWS allows you to make snapshots of EC2's and databases (RDS). The main purpose for that is to make backups, but people sometimes use snapshots to get access back to their own EC2's when they forget the passwords.
Look for snapshots this user has access to (note the SnapshotId):
If you run that command without specifying the --owner-id you can see how many publicly available EC2 snapshots are.
Create a copy of the backup:
Mount it in a EC2 VM under your control (it has to be in the same region as the copy of the backup):
step 1: Head over to EC2 –> Volumes and create a new volume of your preferred size and type.
Step 2: Select the created volume, right click and select the “attach volume” option.
Step 4: Now, login to your ec2 instance and list the available disks using the following command.
The above command will list the disk you attached to your instance.
Step5:
****
****
And finally call the function accessing (notice that the ID, Name and functoin-name appears in the URL):
Try the tool:
Step 3: Select the instance from the instance text box as shown below.
If you want to read about how can you exploit meta-data in AWS
