AWSBucketDump

AWSBucketDump AWSBucketDump is a tool to quickly enumerate AWS S3 buckets to look for loot. It's similar to a subdomain bruteforcer but is made specifically for S3 buckets and also has some extra features that allow you to grep for delicious files as well as download interesting files if you're n...

SeaweedFS <= 4.29 - Path Traversal File Write

SeaweedFS versions through 4.29 build the S3 API and Iceberg REST catalog routers with mux.NewRouter.SkipCleantrue, which disables URL path cleaning. A .. segment in the request path therefore survives routing and reaches the handlers unnormalised, so a request such as PUT...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

S3Scanner

S3Scanner A quick and dirty script to find unsecured S3 buckets and dump their contents 💧 Using The tool has 2 parts: 1 - s3finder.py This script takes a list of domain names and checks if they're hosted on Amazon S3. Found S3 domains are output to file with their corresponding region in format...

slurp-1

slurp Blackbox/whitebox S3 bucket enumerator Overview Credit to all the vendor packages that made this tool possible. This is a security tool; it's meant for pen-testers and security professionals to perform audits of s3 buckets. Features Scan via domains; you can target a single domain or a list...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

bucket-stream

🚨 Bucket Stream 已不再维护。如果您需要红队行动的支持或咨询，请发送邮件至 [email protected] 🚨 Bucket Stream 通过监控证书透明度日志发现有趣的 Amazon S3 存储桶。 该工具仅监听各种证书透明度日志（通过 certstream），并尝试从证书域名的排列中寻找公开的 S3 存储桶。 请负责任地使用。 我创建此工具主要是为了强调公开 S3 存储桶相关的风险，并为常规的字典攻击提供不同的思路。如果您使用 S3 存储桶，以下是一些快速提示： 1. 随机化您的存储桶名称！没有必要使用...

flumberboozle

flumberboozle Suite of programs meant to aid in bug hunting and security assessments Why this weird name? Just because I heard it first here so I thought this meaningless word would be fitting name of a repository I don't know what I'm going to do with. Contents This repository contains scripts...

mass3

通过DNS而非HTTP快速枚举预编译的AWS S3存储桶列表，使用DNS解析器列表和多线程。警告：请注意，这是非常糟糕的Golang代码。我在没有任何Go语言基础知识的情况下编写了它，但它似乎能起作用。欢迎贡献代码，让工具变得更好！ 安装 root@kitploit: go get -u github.com/smiegles/mass3 用法 root@kitploit: mass3 -w ./lists/buckets.txt -r ./lists/resolvers.txt -t 100 参数 参数| 说明 ---|--- -w|...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. Flan Scan is a wrapper over Nmap and the vulners script which turns Nmap into a...

slurp-old

slurp Enumerates S3 buckets manually or via certstream Overview First of all, credit to https://github.com/eth0izzle/bucket-stream for the certstream idea. Also, credit to all the vendor packages that made this tool possible. Not responsible for how you use this tool. Modes Certstream Domain...

CVE-2023-43040

CVE-2023-43040 Este repositório contém um exploit de prova de conceito para a vulnerabilidade CVE-2023-43040 encontrada no RADOS Gateway RADOSGW. Esta vulnerabilidade permite que atacantes enviem objetos para qualquer bucket acessível pela chave de acesso especificada, potencialmente levando à...

EUVD-2026-42285

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read...

EUVD-2026-42286

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets...

CVE-2026-55067

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55066

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-54917-SeaweedFS-Cross-Bucket-Traversal

CVE-2026-54917 — SeaweedFS S3 gateway: path traversal tra bucket Proof-of-concept e analisi tecnica per CVE-2026-54917 , un path traversal nel gateway API S3 di SeaweedFS che consente a un chiamante di accedere a oggetti in qualsiasi bucket , indipendentemente da ciò per cui le sue credenziali so...

GHSA-569V-Q83C-3J3G Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...