CVE-2026-90614

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

CVE-2026-90603

CVE-2026-90603 affects Anil-matcha Open-Generative-AI versions up to 1.0.11/2.0.0 . The vulnerability resides in the S3 Upload component, specifically the /api/upload-binary endpoint, where manipulation of the x-proxy-target-url argument enables an unrestricted upload . An unauthenticated remote ...

bucky

Bucky 一个S3账户ID枚举与存储桶发现工具 给定一个可访问的S3存储桶，bucky会提取其所属的12位AWS账户ID，然后通过模糊测试存储桶名称（使用一个单词列表）来发现同一账户下的其他存储桶——所有这些都通过一条命令完成。 功能说明 1. 枚举账户ID — 利用s3:ResourceAccountIAM条件键，通过内联STS会话策略逐位暴力破解12位AWS账户ID 2. 发现更多存储桶 — 使用并发工作者从单词列表中模糊测试存储桶名称，以查找同一账户下的其他存储桶 3. 报告所有信息 — 账户ID、存储桶区域以及所有发现的存储桶 为何重要...

domain

Info Recon-ng and Alt-DNS are awesome. This script combines the power of these tools with the ability to run multiple domains within the same session. TLDR; I just want to do my subdomain discovery via ONE command and be done with it. Only 1 module needs an api key /api/googlesite find instructio...

mass3

通过DNS而非HTTP快速枚举预编译的AWS S3存储桶列表，使用DNS解析器列表和多线程。警告：请注意，这是非常糟糕的Golang代码。我在没有任何Go语言基础知识的情况下编写了它，但它似乎能起作用。欢迎贡献代码，让工具变得更好！ 安装 root@kitploit: go get -u github.com/smiegles/mass3 用法 root@kitploit: mass3 -w ./lists/buckets.txt -r ./lists/resolvers.txt -t 100 参数 参数| 说明 ---|--- -w|...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

s3enum

s3enum s3enum is a fast and stealthy Amazon S3 bucket enumeration tool. It leverages DNS instead of HTTP, which means that requests are not logged in S3 server access logs. It was originally built back in 2016 to target GitHub. Installation root@kitploit: go install github.com/koenrh/s3enum@lates...

s3enum

s3enum s3enum 是一个快速且隐秘的 Amazon S3 存储桶枚举工具。它利用 DNS 而非 HTTP，这意味着请求不会被记录在 S3 服务器访问日志中。 它最初于 2016 年构建，用于 针对 GitHub 的漏洞赏金狩猎。 安装 root@kitploit: go install github.com/koenrh/s3enum@latest 用法 你需要指定目标的基础名称（例如 hackerone）、一个单词列表和一个后缀列表。候选存储桶名称通过将目标名称与每个单词组合（使用 -、、...

festin

FestIN——强大的S3存储桶发现与内容探测工具 什么是FestIn 为什么选择FestIn 安装 使用Python 使用Docker 完整选项 用法 配置搜索域名 并发 HTTP爬取配置 管理结果 代理使用 DNS选项 全文搜索支持 作为服务运行（监控模式） 示例：结合FestIn与DnsRecon 步骤1 - 使用所需选项对目标域名运行dnsrecon并保存输出 步骤2 - 准备上一步生成的文件以供FestIn使用 步骤3 - 使用所需选项运行FestIn并保存输出 -...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

SeaweedFS <= 4.29 - Path Traversal File Write

SeaweedFS versions through 4.29 build the S3 API and Iceberg REST catalog routers with mux.NewRouter.SkipCleantrue, which disables URL path cleaning. A .. segment in the request path therefore survives routing and reaches the handlers unnormalised, so a request such as PUT...

WordPress S3 Video <=0.983 - Cross-Site Scripting

WordPress S3 Video and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

karton

Karton 基于Python、Redis和S3的分布式恶意软件处理框架。 理念 Karton 是一个稳健的框架，用于创建灵活 且轻量级 的恶意软件分析后端。它可以用于将恶意软件分析系统连接成一个稳健的流水线，几乎无需繁琐操作。 我们在自动化领域已经深耕多年。面对越来越多的威胁，我们不得不将所有工作自动化以跟上事件响应的节奏。正因为如此，我们经常最终得到许多用胶带 和WD-40拼凑在一起的脚本。这些脚本是分析师在紧急时刻编写的，脆弱且丑陋——但它们能工作，能产生必须存储、进一步处理、发送到其他系统或与其他组织共享的情报。...

trufflehog

TruffleHog Find leaked credentials. 🔎 Now Scanning ...and more To learn more about TruffleHog and its features and capabilities, visit our product page. 🌐 TruffleHog Enterprise Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint and more for...

s3-leaks

s3-leaks Lista de fugas de AWS S3 No dudes en enviar un PR si conoces otras fugas...

CVE-2025-2825

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass CVE-2025-2825 PoC This script exploits the CrushFTP authentication bypass vulnerability in versions: 10.0.0 10.8.3 11.0.0 11.3.0 How It Works CrushFTP's AWS S3-style authentication can be bypassed using: A fake but valid-looking...

aws_pwn

AWS pwn 摘要 这组脚本写得很烂，用于执行与AWS渗透测试相关的各种任务。如果它对您不起作用，请不要难过。可能是因为自编写以来AWS已经发生了变化，或者代码本身就很烂。无论如何，欢迎贡献。 这些垃圾大部分由Daniel Grzelak编写，但也有很多贡献，最著名的是Mike Fuller。 需求 root@kitploit: pip install -r requirements.txt 请确保还在 /.aws/credentials 中设置好您的AWS凭证。 侦察 用于前期信息收集的任务。 validateiamaccesskeys.py -...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...