Add New Detectors/Extractors for detecting potential Non-Existing Cloud Buckets being Used in Codes

[zy9ard3]

Hi Team,

Hope All are going well !!

Description :

Just like exposing Secrets in codes, using a Non-Existing/Unclaimed cloud buckets in codes are also potential dangerous issue which may end-up in Code Execution/Malware Distribution on servers when claimed by attackers

Description of the Preferred Solution :

Detecting and Fixing the Non-Existing/Unclaimed Buckets from Codes using detectors with regexes like ;

• ([A-Za-z0-9\._-]*)?s3((\.|-)(website(\.|-))?(us|af|ap|ca|eu|me|sa)-(east|west|north|south|northeast|southeast|central)-[1-9])?\.amazonaws\.com(\/([A-Za-z0-9\._-]*))?

• [a-z0-9_-]*\.(us|af|ap|ca|eu|me|sa)\-(east|west|south|northeast|southeast|central)\-[1-9]+\.elasticbeanstalk\.com

• ([A-Za-z0-9\._-]*)?storage\.googleapis\.com(\/([A-Za-z0-9\._-]*))?

Additional Context :

An example reference for buckets using in code

References :

https://hackerone.com/reports/1285598

Thanks & Regards,
@zy9ard3