subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

s3enum

s3enum s3enum is a fast and stealthy Amazon S3 bucket enumeration tool. It leverages DNS instead of HTTP, which means that requests are not logged in S3 server access logs. It was originally built back in 2016 to target GitHub. Installation root@kitploit: go install github.com/koenrh/s3enum@lates...

s3tk

s3tk A security toolkit for Amazon S3 🍊 Battle-tested at Instacart Installation Run: root@kitploit: pip install s3tk You can use the AWS CLI or AWS Vault to set up your AWS credentials: root@kitploit: pip install awscli aws configure See IAM policies needed for each command. Commands Scan Scan yo...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

s3crets_scanner

S3cret Scanner: Hunting For Secrets Uploaded To Public S3 Buckets S3cret Scanner tool designed to provide a complementary layer for the Amazon S3 Security Best Practices by proactively hunting secrets in public S3 buckets. Can be executed as scheduled task or On-Demand Automation workflow The...

s3tk

s3tk Un conjunto de herramientas de seguridad para Amazon S3 🍊 Probado en combate en Instacart Instalación Ejecuta: root@kitploit: pip install s3tk Puedes usar la AWS CLI o AWS Vault para configurar tus credenciales de AWS: root@kitploit: pip install awscli aws configure Consulta las políticas de...

s3enum

s3enum s3enum es una herramienta rápida y sigilosa para la enumeración de buckets de Amazon S3. Utiliza DNS en lugar de HTTP, lo que significa que las solicitudes no quedan registradas en los registros de acceso del servidor S3. Originalmente fue creada en 2016 para apuntar a GitHub. Instalación...

bucket-stream

🚨 Bucket Stream ya no recibe mantenimiento. Si necesitas soporte o consultoría para tus esfuerzos de red team, envíame un correo a [email protected] 🚨 Bucket Stream Encuentra buckets interesantes de Amazon S3 observando los registros de transparencia de certificados. Esta herramienta...

[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

CVE-2026-46413

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...

[SECURITY] Fedora 43 Update: rclone-1.74.3-1.fc43

"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Driv e, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azure Files, Yandex Files...

GHSA-XV9W-7V6Q-HPJH fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limit...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the process that retrieves S3 signature images. An attacker can access temporary signed S3 URLs for signature images by knowing the filename, allowi...

GHSA-6MMJ-JHQJ-6C6Q Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize call used by the local-file branch. Key evidenc...

PT-2026-51454

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.0 Description An authentication bypass exists in the Budibase server route POST /api/attachments/:datasourceId/url because it lacks the authorized... middleware. An anonymous attacker who can enumerate a workspa...

CVE-2025-10560 Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...

CVE-2026-48768 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any...

CVE-2026-42810

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the nextSplit function in the S3 Select CSV parsing process. An attacker can cause the server to exhaust available memory and crash by uploading a specially crafted CSV file with...

CVE-2026-35200

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the...