Module: Grayhatwarfare

[aconite33]

Description

• Add ability to search Open S3 Buckets based on keyword search (https://grayhatwarfare.com/packages)
• Add ability to search authenticated S3 Buckets based on keyword search

[TheTechromancer]

This functionality already exists for aws, azure, digital ocean, and google cloud. The bucket_* modules automatically try DNS names as buckets (e.g. www.tesla.com will be tried as tesla.s3.amazonaws.com, www.tesla.com.s3.amazonaws.com, www-tesla-com.s3.amazonaws.com, etc.) Each of these modules also has a "permutations" option which will try all kinds of mutations like -dev, -test, etc.

If you enable httpx, web responses are also parsed for buckets. If the bucket_* modules are enabled, all buckets will be checked to see whether they are open, with the exception of Azure because of how they handle permissions.

EDIT: This was added in #164

[TheTechromancer]

We've held off so far on creating a grayhatwarfare module (Spiderfoot has one) because it has the potential to create lots of false positives. E.g. a scan against "tesla.com" would probably yield hundreds or thousands of results for things like some-random-persons-tesla-fanpage which would need to be manually verified, since there's no way to automatically check whether the bucket is actually related to the target.