Cloud
AWS
s3
disclosing bucket names
Using Errors
If you find a static website hosted using s3 and want to find the orignal bucket name that's hosting the content , we can use the this script to find the orignal bucket.
The screenshot below shows a website hosted on s3
To find the orignal bucket name RUN
It sends multiple request to endpoint with certain characters trying to error & leak the bucketname.
With CNAME/NLOOKUP
The domain could just be an alias of the S3 endpoint
FQDN
Another common setup, the fully qualified domain name (FQDN) could be the actual S3 bucket name. example, the FQDN in this case would be d278x994b7tw25.cloudfront.net, so we can try to check if it exists or not:
internally redirection referencing the S3 bucket by URL path
Google GCP
Google storage(s3 equivalent of GCP)
If you find a static website hosted using google storage and want to find the orignal bucket name that's hosting the content , we can use the same script to find the orignal bucket.
http://5fc0081be20b5faabf10b.ctf.hackaplaneten.se/xyzabc/okok?AWSAccessKeyId=AKIAIRD3G7SO7PDREOYA&Expires=1685104439&Signature=this request with accessid without signature errors for gcloud and leaks the bucket
Refrences:
Last updated