s3-leaks

s3-leaks List of AWS S3 Leaks Feel free to send in a PR if you know of other leaks Date| Description| Notes ---|---|--- April 2025| Thoughts of AWS Access key ID's from an S3 bucket| The keys to the AWS kingdom March 2025| 16,000 subscribers to Nine newspapers from Australia| name, postal address...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install GO111MODULE=on go install github.com/jaeles-project/gospider@latest Docker...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

sandcastle

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

goGetBucket

goGetBucket - AWS S3 Bucket discovery through alterations and permutations Warning: code is horrible as I have only used this for personal use. When I get the time I will make it less-horrible and faster. When performing a recon on a domain - understanding assets they own is very important. AWS S...

s3-account-search

S3 Account Search This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you...

CVE-2025-2825

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass CVE-2025-2825 PoC This script exploits the CrushFTP authentication bypass vulnerability in versions: 10.0.0 10.8.3 11.0.0 11.3.0 How It Works CrushFTP's AWS S3-style authentication can be bypassed using: A fake but valid-looking...

binaryalert

BinaryAlert: Detección de malware sin servidor, en tiempo real y retrospectiva .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Estado de compilación .. image::...

s3sec

s3sec Prueba los buckets de AWS S3 para acceso de lectura/escritura/eliminación Esta herramienta fue desarrollada para probar rápidamente una lista de buckets de S3 para acceso público de lectura, escritura y eliminación con fines de pruebas de penetración en programas de bug bounty. Screenshot...

CVE-2026-62035

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

CVE-2026-62035 WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

EUVD-2026-96470

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

CVE-2026-62035

The AWS S3 for WordPress Plugin (specifically the Upcasted version) is vulnerable to a Broken Access Control issue in versions

PT-2026-109802

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, crossplane-provider-kubernetes-fips, cloudbeat, external-dns-fips, cloud-sql-proxy-fips, crossplane-provider-azure-eventhub, secrets-store-csi-driver-provider-aws-fips, gitlab-runner-fips, gitness, sftpgo, bank-vaults-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, crossplane-provider-kubernetes-fips, cloudbeat, external-dns-fips, cloud-sql-proxy-fips, crossplane-provider-azure-eventhub, secrets-store-csi-driver-provider-aws-fips, gitlab-runner-fips, gitness, sftpgo, bank-vaults-fips,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, crossplane-provider-kubernetes-fips, cloudbeat, external-dns-fips, cloud-sql-proxy-fips, crossplane-provider-azure-eventhub, secrets-store-csi-driver-provider-aws-fips, gitlab-runner-fips, gitness, sftpgo, bank-vaults-fips,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, cloud-provider-vsphere, external-secrets-operator, crossplane-provider-azure-managedidentity, migrate, telegraf, timoni, ratify, litestream, rabbitmq-cluster-operator, nri-discovery-kubernetes, continuity, knative-operator, containerd...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, amass, cloud-provider-vsphere, gh, external-secrets-operator, crossplane-provider-azure-managedidentity, migrate, telegraf, timoni, ratify, litestream, rabbitmq-cluster-operator, cerbos, nri-discovery-kubernetes, continuity, spegel,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, amass, cloud-provider-vsphere, gh, external-secrets-operator, crossplane-provider-azure-managedidentity, migrate, telegraf, timoni, ratify, litestream, rabbitmq-cluster-operator, cerbos, nri-discovery-kubernetes, continuity, spegel,...