S3 - Enum Basics - PwnedLabs

For example we have a website that is fetching resources from an S3 bucket. In the view source we spot the following:

In AWS we have the following type of buckets:

1. Amazon S3 Buckets (Object Storage)
General-Purpose Buckets – For storing any kind of object (files, images, logs, backups, etc.).
Static Website Hosting Buckets – Configured to serve a website directly from S3.
Logging Buckets – Used for storing access logs from CloudTrail, ALB, or S3 itself.
Data Lake Buckets – Used for storing large-scale data for analytics (e.g., AWS Lake Formation).
Backup Buckets – Used to store backups from AWS Backup or other services.
Machine Learning Data Buckets – For training ML models with AWS SageMaker.

From the AWS documentation here, we observe the following:

  1. Every object in a bucket has a URL that can be used to access it. As Amazon states: "Every object is contained in a bucket. For example, if the object named photos/puppy.jpg is stored in the amzn-s3-demo-bucket bucket in the US West (Oregon) Region, then it is addressable by using the URL https://amzn-s3-demo-bucket.s3.us-west-2.amazonaws.com/photos/puppy.jpg"

  2. In our source code above, we have "https://s3.amazonaws.com/dev.huge-logistics.com/static/style.css" which means name of the bucket is dev.huge-logistics.com. Although it is not in the format stated above. GPT explains this: 1️⃣ Virtual-Hosted Style URL (Modern Default)

    Most AWS documentation now suggests using the virtual-hosted style URL format, where the bucket name appears as a subdomain:

    For example, if the bucket is amzn-s3-demo-bucket in us-west-2, an object called photos/puppy.jpg would be accessed at:

    This is now the default method for accessing objects in newer AWS regions. 2️⃣ Path-Style URL (Older Format, Used in Some Cases)

    The URL you provided follows the older path-style access method:

    Your example:

    Here:

    • s3.amazonaws.com is the base S3 endpoint.

    • dev.huge-logistics.com is the bucket name.

    • /static/style.css is the object path.

    AWS allowed this format for a long time, but in 2019, AWS announced that path-style URLs are being deprecated for new buckets in most regions. However, older buckets or buckets in legacy regions (like us-east-1) still support it.

  3. Okay so we can enumerate it.

Any command help in AWS is generally in the format:

aws <module> <additional API call (if any)> help

So, aws s3 help would tell that you can run "ls" to enumerate

The following command would do a recursive "ls." If it can't access anything it would throw an error.

Similarly one can look in a specific folder by appending the folder name in the URL

However, we don't have access to admin and migration-files right now. We can copy the hl_migration_project.zip to current folder like so:

We see access keys in one of the files. This is a bad practice.

We can configure these credentials using "aws configure" command and access other folders

But I couldn't access these. So I accessed other folder

It had this line:

^ I configured the compromised access keys and accessed the flag that way.

PreviousEnumerationNextS3 - Identify the AWS Account ID from a Public S3 Bucket

Last updated

Was this helpful?