Search the Community

S3cret Scanner: Hunting For Secrets Uploaded To Public S3 Buckets S3cret Scanner tool is designed to provide a complementary layer for the Amazon S3 Security Best Practices by proactively hunting secrets in public S3 buckets. Can be executed as a scheduled task or On-Demand Automation workflow The automation will perform the following actions: List the public buckets in the account (Set with ACL of Public or objects can be public) List the textual or sensitive files (i.e. .p12, .pgp and more) Download, scan (using truffleHog3), and delete the files from the disk, once done evaluating, one by one. The logs will be created in the logger.log file. [hide][Hidden Content]]

A tool to find open S3 buckets and dump their contents The tool takes in a list of bucket names to check. Found S3 buckets are output to file. The tool will also dump or list the contents of ‘open’ buckets locally. Features ⚡️ Multi-threaded scanning 🔭 Supports tons of S3-compatible APIs 🕵️‍♀️ Scans all bucket permissions to find misconfigurations 💾 Dump bucket contents to a local folder 🐳 Docker support Changelog v2.0.2 Fixes #122 – CVE-2021-32061: Path Traversal via dump of malicious bucket [hide][Hidden Content]]