Giter Club home page Giter Club logo

s3rec0n's Introduction

S3Rec0n

Open Source Love python GitHub version Open Source Love

A colorful cross-platform python utility to test misconfigurations of buckets both through authenticated and unauthenticated checks!

Requirements

  • Python (3.7.*)
  • Python pip3
  • Python module boto3
  • Python module botocore
  • Python module jmespath
  • Python module pygments
  • Python module requests

Install python && modules

sudo apt install python3 python3-pip python3-venv
mkdir ~/.venvs/S3Rec0n/ && python3 -m venv ~/.venvs/S3Rec0n/ && source ~/.venvs/S3Rec0n/bin/activate
pip install -r requirements.txt

Tested on

  • Pop! OS 18.04
  • Kali linux (2019.1)
  • Ubuntu 18.04 LTS
  • Windows 8/8.1/10
  • Subsystem Linux

Download/Clone S3Rec0n

You can download the latest version of S3Rec0n by cloning the GitHub repository. As a best practice, please use python's virtual environment (venv) while running the script to avoid any modules/packages installation errors.

git clone https://github.com/Ebryx/S3Rec0n

Usage

Initializing Script

python s3rec0n.py

Listing Bucket without S3 API Authorization (anonymously)

python s3rec0n.py --unauthorized --list-bucket --bucket=myTestBucket

Listing Bucket with S3 API Authorization (using access keys)

python s3rec0n.py --authorized --list-bucket --bucket=myTestBucket

Listing Bucket without specifying any flag both auth/unauth S3 API Call (by default it gets set to unauthorized)

python s3rec0n.py --list-bucket --bucket=myTestBucket

Fetching ACL of the Bucket without S3 API Authorization (anonymously)

python s3rec0n.py --unauthorized --get-acl --bucket=myTestBucket

Putting/Over-writing the ACL of the Bucket without S3 API Authorization (anonymously)

python s3rec0n.py --unauthorized --put-acl --bucket=myTestBucket

Fetching readable objects of the Bucket without S3 API Authorization (anonymously)

python s3rec0n.py --unauthorized --readable-objs --bucket=myTestBucket

Trying and uploading a test object on the Bucket without S3 API Authorization (anonymously)

python s3rec0n.py --unauthorized --upload-objs --bucket=myTestBucket

Fetching ACLs of all the objects of the Bucket without S3 API Authorization (anonymously)

python s3rec0n.py --unauthorized --fetch-obj-acl --bucket=myTestBucket

Description of Checks


Usage: python s3rec0n.py
Features/Functions:

 1). Authenticated Checks (through access keys)
 2). Unauthenticated Checks (anonymously)
 3). Buckets Location (AWS Region)
 4). Static Website Hosting Check
 5). Bucket Listing
 6). Fetching ACL (Access Control List) of the Bucket
 7). Over-writing ACL of the bucket (be careful!)
 8). Finding readable objects in the bucket
 9). Uploading test key/object for misconfiguration test
 10). Fetch ACLs of all the Objects
  
  Example:
	python s3rec0n.py

Some GIFS

Note

 Feel free to make pull requests!
P.S ~ Dont Change The Colors. They're Butiphul like this.
	~ An0n 3xPloiTeR

s3rec0n's People

Contributors

anon-exploiter avatar dependabot[bot] avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

s3rec0n's Issues

Deletion of Objects Feature

A feature request from a fellow colleague to implement the deletion of keys/objects too.

Details

The feature will have to be explicitly specified to run and also it won't be included in --all argument.

  • Will work on the PR soon!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.