password123456 / s3-audit Goto Github PK

View Code? Open in Web Editor NEW

simple dictionary based read, write, delete permission audit tool for aws s3 written in python.

HTML 1.92% Python 98.08%

s3-audit's Introduction

s3_audit

Simple dictionary based read, write, delete permission audit tool for aws s3 bucket written in python.
Need to aws-cli (Here get it.)
The scan result only show 'true/ false /not given'
if you see the true flag in the result, have to further scanning or do others ways to find out vulnerability.
Get the ACL of the S3 bucket using aws credential(access_key method) and fix the vulnerable permission.

Documentation

# pip install requests
# python main.py

Output

##### Scan Completed ####
1,2022-04-12 19:39:52 yours3domain.s3.ap-northeast-1.amazonaws.com [ListObject: False, PutObject: False, DeleteObject: False]
2,2022-04-12 19:39:56 yours3domain.s3.amazonaws.com [ListObject: False, PutObject: False, DeleteObject: False]

##### This is not S3(?). Make sure domain is correct. ####
1,2022-04-12 19:39:56 nots3domain.com [ListObject: Not_Given, PutObject: Not_Given, DeleteObject: Not_Given]
2,2022-04-12 19:39:56 nots3domain.com [ListObject: Not_Given, PutObject: Not_Given, DeleteObject: Not_Given]
3,2022-04-12 19:39:56 nots3domain.com [ListObject: Not_Given, PutObject: Not_Given, DeleteObject: Not_Given]
4,2022-04-12 19:39:56 nots3domain.com [ListObject: Not_Given, PutObject: Not_Given, DeleteObject: Not_Given]

Recommend Projects