S3Scanner: finding exposed cloud storage buckets

S3Scanner · MIT

S3Scanner checks whether cloud storage buckets exist and what permissions they expose. It covers S3 and S3-compatible providers, and reads permissions without needing credentials for the target account.

Install

pipx install s3scanner
# or
docker run --rm ghcr.io/sa7mon/s3scanner scan --bucket example-assets

Core commands

# one bucket
s3scanner scan --bucket example-assets

# a candidate list
s3scanner scan --buckets-file candidates.txt

# generate candidates from a company name
s3scanner scan --bucket-name-file names.txt --enumerate

# JSON output
s3scanner --json scan --buckets-file candidates.txt > buckets.json

# non-AWS providers
s3scanner --endpoint-url https://storage.googleapis.com scan --bucket example-assets

Output

{"bucket":"example-assets","exists":true,"region":"us-east-1",
 "permissions":{"AuthUsers":{"read":true,"write":false},"AllUsers":{"read":true,"write":false}}}

AllUsers.read: true means anonymous read. That is the finding.

Where it sits in Tandera

S3Scanner is the core of recon_cloud_enum — the unauthenticated cloud-footprint flow that runs from a domain seed and needs no access to the client’s cloud account. That distinguishes it from recon_cloud, which runs prowler and scoutsuite against an authenticated, already-connected account.

It runs in discovery, alongside cdncheck.

Using it in a pentest

Read the permission, do not exercise it. Confirming AllUsers.read is the finding. Downloading the contents is data handling you were probably not authorised to do, and it changes the engagement’s legal posture. Capture the permission state as evidence and stop.

Write permission is a critical, always. AllUsers.write on a bucket serving a website is site defacement or supply-chain compromise. It outranks almost anything else you will find that day.

Guess names from what you already have. Bucket names mirror the organisation: example-assets, example-backups, example-prod-logs. Build the candidate list from hostnames your recon already produced rather than a generic list.

Buckets belong to accounts, not domains. Verify a bucket is actually the client’s before reporting it. Name similarity is not ownership.