S3CMD Configuration - Detect

S3CMD configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """S3CMD configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'S3CMD Configuration - Detect',...

GSA Bounty: Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov

Hi Team, I noticed, that the x-amz-meta-s3cmd-attrs response header returns sensitive information, like system username on data.gov x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33184/mtime:1513269652/atime:1513269652/md5:2049644b6b833f5dbb826f60a4721f64/ctime:1513269652 Server:...

GSA Bounty: Information disclosure (system username) in the x-amz-meta-s3cmd-attrs response header on federation.data.gov

Description Hi. I just noticed, that you are extended the scope for the bounty program. I looked to the first resource - https://federation.data.gov/ I noticed, that the x-amz-meta-s3cmd-attrs response header returns sensitive information, like system username:...

HackerOne: Obtain the username & the uid of the one doing the S3 sync on Hackerone

Obtain the username & uid of hackerone.com S3 using GET, it's possible to obtain the username & uid of the one doing the S3 sync on Hackerone. Doing a GET on : http://hackerone.com Give the following header : content-security-policy = default-src 'none'; base-uri 'self'; block-all-mixed-content;...