Ethical Hacking News Hubb
Advertisement Banner
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
Wellnessnewshubb
No Result
View All Result
Home News

Hunting For Secrets Uploaded To Public S3 Buckets

admin by admin
December 23, 2022
in News




  • S3cret Scanner tool designed to provide a complementary layer for the Amazon S3 Security Best Practices by proactively hunting secrets in public S3 buckets.
  • Can be executed as scheduled task or On-Demand

Automation workflow

The automation will perform the following actions:

  1. List the public buckets in the account (Set with ACL of Public or objects can be public)
  2. List the textual or sensitive files (i.e. .p12, .pgp and more)
  3. Download, scan (using truffleHog3) and delete the files from disk, once done evaluating, one by one.
  4. The logs will be created in logger.log file.

Prerequisites

  1. Python 3.6 or above
  2. TruffleHog3 installed in $PATH
  3. An AWS role with the following permissions:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetLifecycleConfiguration",
"s3:GetBucketTagging",
"s3:ListBucket",
"s3:GetAccelerateConfiguration",
"s3:GetBucketPolicy",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketPolicyStatus",
"s3:GetBucketAcl",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
]
}
  1. If you’re using a CSV file – make sure to place the file accounts.csv in the csv directory, in the following format:
Account name,Account id
prod,123456789
ci,321654987
dev,148739578

Getting started

Use pip to install the needed requirements.

Usage
Argument Values Description Required
-p, –aws_profile The aws profile name for the access keys ✓
-r, –scanner_role The aws scanner’s role name ✓
-m, –method internal the scan type ✓
-l, –last_modified 1-365 Number of days to scan since the file was last modified; Default – 1 ✗

Usage Examples

python3 main.py -p secTeam -r secteam-inspect-s3-buckets -l 1

Demo

Contributing

Pull requests and forks are welcome. For major changes, please open an issue first to discuss what you would like to change.





Source link

Tags: cybersecurityethical hackinghack androidhack apphack wordpresshacker newshackinghacking tools for windowskeyloggerkitkitploitpassword brute forcepenetration testingpentestpentest androidpentest linuxpentest toolkitpentest toolsspy tool kitspywaretools
Previous Post

Blood Origin season 1 online

Next Post

W4SP Stealer Discovered in Multiple PyPI Packages Under Various Names

Next Post

W4SP Stealer Discovered in Multiple PyPI Packages Under Various Names

Recommended

Create Infinite UAC Prompts Forcing A User To Run As Admin

5 months ago

Google Accuses Spanish Spyware Vendor of Exploiting Chrome, Firefox, & Windows Zero-Days

2 months ago

© 2022 Ethical Hacking News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Ethical Hackers
  • Contact

Newsletter Sign Up.

No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact

© 2022 Ethical Hacking News Hubb All rights reserved.