AWS Pwn - A Collection Of AWS Penetration Testing Junk

This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please feel free to...

Design/Logic Flaw

Receipt of a specially crafted Connectionless Network Protocol CLNP datagram destined to an interface of a Junos OS device may result in a kernel crash or lead to remote code execution. Devices are only vulnerable to the specially crafted CLNP datagram if 'clns-routing' or ES-IS is explicitly...

goGetBucket - A Penetration Testing Tool To Enumerate And Analyse Amazon S3 Buckets Owned By A Domain

When performing a recon on a domain - understanding assets they own is very important. AWS S3 bucket permissions have been confused time and time again, and have allowed for the exposure of sensitive material. What this tool does, is enumerate S3 bucket names using common patterns I have identifi...

s3.amazonaws.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-594144 Description| Value ---|--- Affected Website:| s3.amazonaws.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Udemy: S3 bucket unnecessarily discloses permissions

The 'udemy-images' bucket allows the 'AllUsers' group to list ACLs that are applied to the bucket. By navigating to: https://udemy-images.udemy.com or by using the aws-cli tool an attacker can see which users have READ, WRITE, READACP, and WRITEACP rights. Doing this now we can see one user who h...

Mapbox: Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issues

On March 25, 2018 @fransrosen reported a vulnerability to Mapbox. An AWS S3 bucket previously owned by Mapbox was reclaimed by this researcher, which is possible due to the global namespacing of S3 buckets. This bucket was still actively referenced in a test script. The bucket takeover therefore...

S3Scanner - Scan For Open S3 Buckets And Dump

A quick and dirty script to find unsecured S3 buckets and dump their contents. Using The tool has 2 parts: 1 - s3finder.py This script takes a list of domain names and checks if they're hosted on Amazon S3. Found S3 domains are output to file with their corresponding region in format...

Walmart Jewelry Partner Exposes Personal Data Of 1.3M Customers

A misconfigured Amazon S3 Simple Storage Service bucket, managed by a Walmart jewelry partner, left personal details and contact information of 1.3 million customers exposed to the public internet. The S3 repository containing a MSSQL database backup belongs to MBM Company, a Chicago, Ill.-based...

Walmart Jewelry Partner Exposes Data of Millions of Customers

By Waqas Unsecured Amazon S3 Bucket Claims Another Victim - This Time, This is a post from HackRead.com Read the original post: Walmart Jewelry Partner Exposes Data of Millions of Customers...

CVE-2016-8520

HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...

CVE-2016-8520

HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data...

CVE-2016-8520

CVE-2016-8520 affects HPE Helion Eucalyptus (v4.3.0 and earlier). The root cause is improper IAM permission checks when accessing versioned S3 objects and ACLs, enabling in some cases authenticated users with S3 permissions to access versioned data. The NVD entry documents a network-vector, low c...

Snapchat: Takeover 2 MAIN DOMAINS of a company Acquired by Snapchat

Hi, As you may realize I noted "Domain" and not subdomain because actually, I was able to take over the MAIN domain of a company Acquired by Snapchat. As you can see in the screenshot below, when you type "Addlive" in Google https://goo.gl/EAxBaj , the first two results will be: F261984 First one...

Serverless, Low Cost, Threat Intel Aggregation: ElasticIntel

ElasticIntel is serverless, low cost, threat intel aggregation for enterprise or personal use, backed by ElasticSearch. It is an alternative to expensive threat intel aggregation platforms which ingest the same data feeds you could get for free. ElasticIntel is designed to provide a central,...

Leaky Amazon S3 Bucket Exposes Personal Data of 12,000 Social Media Influencers

An erroneously configured Amazon S3 Simple Storage Service bucket managed by Paris marketing firm Octoly left contact information and personal details for more than 12,000 social media influencers. Octoly connects popular Instagram, Twitter and YouTube users with companies that provide them...

s3-ap-southeast-1.amazonaws.com XSS vulnerability

Open Bug Bounty ID: OBB-466866 Description| Value ---|--- Affected Website:| s3-ap-southeast-1.amazonaws.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

hf-files-oregon.s3-us-west-2.amazonaws.com XSS vulnerability

Vulnerable URL: https://hf-files-oregon.s3-us-west-2.amazonaws.com/hdpconsensyssupportemailattachments/2017/12-07/6d7e340b-999e-49c6-942c-4420f3af4824/html.html?Signature=MKrOptPkdQEJws1VO29QPlqzX5g%3D=1512659039=AKIAICZBENY5JIPRUNQA Details: Description| Value ---|--- Patched:| Yes, at...

Bucket Stream - Find interesting Amazon S3 Buckets by watching certificate transparency logs

Find interestingAmazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate transparency logs via certstream and attempts to find public S3 buckets from permutations of the certificates domain name. Some quick tips if you use S3 buckets: 1. Randomi...

Semrush: subdomain takeover at news-static.semrush.com

Summary: The subdomain news-static.semrush.com can be taken over by attackers and abuse it for further attacks Phishing, XSS Cross origin, malware, etc... Description: The subdomain news-static.semrush.com was pointed using CNAME to Amazon S3, but no bucket with that name was registered. This mea...

Misconfigured Amazon S3 Buckets Exposed US Military’s Social Media Spying Campaign

By Waqas UpGuard’s security researcher Chris Vickery has discovered three misconfigured AWS This is a post from HackRead.com Read the original post: Misconfigured Amazon S3 Buckets Exposed US Military’s Social Media Spying Campaign...