goGetBucket - A Penetration Testing Tool To Enumerate And Analyse Amazon S3 Buckets Owned By A Domain

When performing a recon on a domain - understanding assets they own is very important. AWS S3 bucket permissions have been confused time and time again, and have allowed for the exposure of sensitive material.

What this tool does, is enumerate S3 bucket names using common patterns I have identified during my time bug hunting and pentesting. Permutations are supported on a root domain name using a custom wordlist. I highly recommend the one packaged within AltDNS.

The following information about every bucket found to exist will be returned:

• List Permission
• Write Permission
• Region the Bucket exists in
• If the bucket has all access disabled

Installation

go get -u github.com/glen-mac/goGetBucket

Usage
goGetBucket -m ~/tools/altdns/words.txt -d <domain> -o <output> -i <wordlist>

Usage of ./goGetBucket:
  -d string
        Supplied domain name (used with mutation flag)
  -f string
        Path to a testfile (default "/tmp/test.file")
  -i string
        Path to input wordlist to enumerate
  -k string
        Keyword list (used with mutation flag)
  -m string
        Path to mutation wordlist (requires domain flag)
  -o string
        Path to output file to store log
  -t int
        Number of concurrent threads (default 100)

Throughout my use of the tool, I have produced the best results when I feed in a list (-i) of subdomains for a root domain I am interested in. E.G:

www.domain.com
mail.domain.com
dev.domain.com

The test file (-f) is a file that the script will attempt to store in the bucket to test write permissions. So maybe store your contact information and a warning message if this is performed during a bounty?
The keyword list (-k) is concatenated with the root domain name (-d) and the domain without the TLD to permutate using the supplied permuation wordlist (-m).
Be sure not to increase the threads too high (-t) - as the AWS has API rate limiting that will kick in and start giving an undesired return code.

Download goGetBucket

Related word

1. Pentest Tools List
2. Hacking Tools Github
3. Bluetooth Hacking Tools Kali
4. Hack Tools For Pc
5. Hack Tools For Windows
6. Hack Tools Download
7. Pentest Tools Review
8. World No 1 Hacker Software
9. Hacker Tools Github
10. Tools For Hacker
11. Pentest Tools Kali Linux
12. Pentest Tools Online
13. Android Hack Tools Github
14. Usb Pentest Tools
15. Hacking Tools Online
16. Hacker Tools Free
17. Pentest Box Tools Download
18. Pentest Recon Tools
19. What Are Hacking Tools
20. Hack Tools
21. Hacking Tools Free Download
22. Easy Hack Tools
23. Hacking Tools Pc
24. Free Pentest Tools For Windows
25. Hacking Tools Usb
26. Hack Website Online Tool
27. Pentest Tools For Ubuntu
28. Pentest Tools Nmap
29. Hackers Toolbox