CVE-2026-115371

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read...

mass3

Quickly enumerate through a pre-compiled list of AWS S3 buckets using DNS instead of HTTP with a list of DNS resolvers and multi-threading. Warning: Be aware that this is really shitty golang code. I wrote it without any prior knowledge of Go Lang but it seems to do the job. Feel free to contribu...

CVE-2026-54917-SeaweedFS-Cross-Bucket-Traversal

CVE-2026-54917 — SeaweedFS S3 gateway cross-bucket path traversal Proof-of-concept and technical write-up for CVE-2026-54917 , a path-traversal in the SeaweedFS S3 API gateway that lets a caller reach objects in any bucket , regardless of what its credentials are authorized for. | ---|--- CVE|...

S3Scanner

S3Scanner Features - Usage - Quick Start - Installation - Discuss A tool to find open S3 buckets in AWS or other cloud providers: AWS DigitalOcean DreamHost GCP Linode Scaleway Custom Features ⚡️ Multi-threaded scanning 🔭 Supports many built-in S3 storage providers or custom 🕵️‍♀️ Scans all...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

AWSBucketDump

AWSBucketDump AWSBucketDump is a tool to quickly enumerate AWS S3 buckets to look for loot. It's similar to a subdomain bruteforcer but is made specifically for S3 buckets and also has some extra features that allow you to grep for delicious files as well as download interesting files if you're n...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

slurp-1

slurp Blackbox/whitebox S3 bucket enumerator Overview Credit to all the vendor packages that made this tool possible. This is a security tool; it's meant for pen-testers and security professionals to perform audits of s3 buckets. Features Scan via domains; you can target a single domain or a list...

sss3

SSS3 Simple Storage Scanner SSS3 is a simple S3 Bucket testing software. It uses aws cli to search for public buckets in a list of domains/subdomains. Basic Requirements It requires aws cli installed and configured with a s3 policy defined You should have a list of previous enumerated...

S3Scanner

S3Scanner A quick and dirty script to find unsecured S3 buckets and dump their contents 💧 Using The tool has 2 parts: 1 - s3finder.py This script takes a list of domain names and checks if they're hosted on Amazon S3. Found S3 domains are output to file with their corresponding region in format...

CVE-2025-27136

CVE-2025-27136 Exploiting an XML External Entity XXE Vulnerability. Use XML Payload to Grab Sensitive Files PoC test.xml Use curl to upload test.xml from our local machine to the bucket. curl -X PUT http://127.0.0.1:PORT/TB1 -H "Content-Type: application/xml" -d @test.xml Trigger the Exploit & Gr...

flumberboozle

flumberboozle Suite of programs meant to aid in bug hunting and security assessments Why this weird name? Just because I heard it first here so I thought this meaningless word would be fitting name of a repository I don't know what I'm going to do with. Contents This repository contains scripts...

CVE-2026-109741

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: Bucket File System component...

GCPBucketBrute

GCPBucketBrute A script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be privilege escalated. This script optionally accepts GCP user/service account credentials and a keyword. Then, a list of permutations will be generated from that keywor...

CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

bucky

Project is on temporary hold. Bucky Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular ExpressionRegex to match the S3 bucket...

sandcastle

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

EUVD-2026-107541

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...