Slurp – Amazon AWS S3 Bucket Enumerator
Detail information about Slurp--Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan from an external perspective or an AWS API to scan internally.
There are two modes that this tool operates at; blackbox and whitebox mode. Whitebox mode (or internal) is significantly faster than blackbox (external) mode.
Blackbox (external)
In this mode, you are using the permutations list to conduct scans. It will return false positives and there is NO WAY to link the buckets to an actual AWS account.
Whitebox (internal)
In this mode, you are using the AWS API with credentials on a specific account that you own to see what is open. This method pulls all S3 buckets and checks Policy/ACL permissions. Your credentials should be in ~/.aws/credentials.
Features:
The main features of Slurp are:
1. Scan via domain(s); you can target a single domain or a list of domains
2. Scan via keyword(s); you can target a single keyword or a list of keywords
3. Scan via AWS credentials; you can target your own AWS account to see which buckets have been exposed
4. Colorized output for visual grep
5. Currently generates over 28,000 permutations per domain and keyword
6. Punycode support for internationalized domains
You can download Slurp tool here: Click Here
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan from an external perspective or an AWS API to scan internally.
There are two modes that this tool operates at; blackbox and whitebox mode. Whitebox mode (or internal) is significantly faster than blackbox (external) mode.
Blackbox (external)
In this mode, you are using the permutations list to conduct scans. It will return false positives and there is NO WAY to link the buckets to an actual AWS account.
Whitebox (internal)
In this mode, you are using the AWS API with credentials on a specific account that you own to see what is open. This method pulls all S3 buckets and checks Policy/ACL permissions. Your credentials should be in ~/.aws/credentials.
Features:
The main features of Slurp are:
1. Scan via domain(s); you can target a single domain or a list of domains
2. Scan via keyword(s); you can target a single keyword or a list of keywords
3. Scan via AWS credentials; you can target your own AWS account to see which buckets have been exposed
4. Colorized output for visual grep
5. Currently generates over 28,000 permutations per domain and keyword
6. Punycode support for internationalized domains
You can download Slurp tool here: Click Here
Comments
Post a Comment