AWS S3 Bucket Enumeration
The s3 mode brute forces Amazon S3 bucket names to find publicly exposed buckets with misconfigured permissions. S3 buckets are a common source of data breaches when left open or misconfigured.
Understanding S3 Buckets
Amazon S3 (Simple Storage Service) is a cloud object storage service. Files are stored in containers called buckets, each with a globally unique name. Bucket names follow the pattern: https://bucket-name.s3.amazonaws.com/.
When a bucket is misconfigured with public read access, anyone on the internet can list its contents and download files. This has led to massive data breaches involving personal information, database backups, source code, and credentials.
Properly Secured
- Bucket is private — no public access
- S3 bucket policy denies all public access
- IAM policies restrict access to specific roles
- Access logging is enabled
Misconfigured
- Public read access enabled
- Anyone can list bucket contents
- Anyone can download files
- No access logging or monitoring
S3 Enumeration Commands
Basic S3 Bucket Scan
1gobuster s3 -w /usr/share/wordlists/s3-buckets.txt
Tests each word in the wordlist as a potential S3 bucket name against AWS endpoints.
Fast Scan with More Threads
1gobuster s3 -w s3-buckets.txt -t 50
Increases thread count for faster enumeration against AWS APIs.
Save Results
1gobuster s3 -w s3-buckets.txt -o s3-results.txt
Saves discovered bucket names for manual inspection and reporting.
What to Do When You Find a Bucket
Warning
Tip
curl https://bucket-name.s3.amazonaws.com/. A 200 response with an XML listing means the bucket is publicly listable.Info