aws-s3-data-finder

Find suspicious files (e.g. data backups, PII, credentials) across a large set of AWS S3 buckets and write the first 200k keys (by default) of listable buckets to a .json or .xml file (in buckets/) via AWS CLI or unauthenticated via HTTP requests.

Name:aws-s3-data-finder

Category:Discovery

Publisher:trickest

Created:9/7/2021

Container:quay.io/trickest/aws-s3-data-finder:244701a

Output Type:

License:Unknown

Source:View Source

Parameters

verbose · boolean

-vPrint verbose (Critical and errors)

endpoint · string

--endpointEndpoint to use if doing an unauth scan. Auth scan will use region in awscli

num-keys · string

-nkNumber of keys to get per bucket

test-mdoe · boolean

--testTest mode to just print the bucket names being run

characters · string

--charactersCharacters to run via random/bruteforce, e.g. abcdefg..

bucket-name · string

-nName to run

start-after · string

-saFor all_chars, start after this string

buckets-list · file · required

-nlList of names to run

very-verbose · boolean

-vvPrint very verbose (critical, errors, and warnings)

run-all-chars · boolean

-acRun all chars

prefix-postfix · string

-ppRun with prefixes and/or postfixes - options: prefix, postfix, both

unauthenticated · boolean

--unauthenticatedRun the search unauthenticated, via web request

ignore-redirects · boolean

--no_follow_redirectDon't follow redirects

rerun-previously · boolean

--rerunRerun previously searched buckets

run-random-chars · boolean

-rcRun random chars

bucket-name-length · string

-ncLength of bucket name

print-bucket-names · boolean

-pPrint buket names as you go

realert-previously · boolean

--realertRealert previously alerted suspicious files