sunilgentyalasunilgentyala/OmniRed/skills/cloud/s3-enum/SKILL.md

s3-enum

Skill5 starsChanged 5 months agoApache-2.0View on GitHub

AWS S3 and cloud storage enumeration methodology. Covers bucket discovery, access control testing, public data exposure, and cross-cloud (GCS, Azure Blob) equivalents.

In this repository33 other files it gives its agents.
- dcsyncSkill
- kerberoastingSkill
- pass-the-hashSkill
- jailbreakingSkill
- model-extractionSkill
- prompt-injectionSkill
- system-prompt-extractionSkill
- jwtSkill
- oauthSkill
- session-attacksSkill
- container-escapeSkill
- iam-privescSkill
- edr-evasionSkill
- initial-accessSkill
- embedding-attacksSkill
- rag-poisoningSkill
- mcp-context-injectionSkill
- mcp-rug-pullSkill
- mcp-tool-poisoningSkill
- osintSkill
- subdomain-enumSkill
- model-tamperingSkill
- cvss4-scoringSkill
- report-writingSkill
- graphqlSkill
- idorSkill
- rceSkill
- sqliSkill
- ssrfSkill
- sstiSkill
- waf-bypassSkill
- xssSkill
- xxeSkill

The file

Create a free account to mount

Files

SKILL.md

Cloud Storage Enumeration

AWS S3

Bucket Discovery

# Naming conventions to test
target.com
target-backups
target-logs
target-dev
target-staging
target-prod
target-assets
target-uploads
target-data
www.target.com
api.target.com

# Automated
gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  --wordlist-extra target,company
lazys3 --wordlist targets.txt

Access Testing

# Check if bucket is public
aws s3 ls s3://target-bucket --no-sign-request

# Download publicly accessible files
aws s3 sync s3://target-bucket . --no-sign-request

# Check ACLs (if you have credentials)
aws s3api get-bucket-acl --bucket target-bucket
aws s3api get-bucket-policy --bucket target-bucket

# List with authenticated credentials
aws s3 ls s3://target-bucket --profile attacker-profile

Misconfigurations to Test

# Write access (upload test)
echo "test" | aws s3 cp - s3://target-bucket/test.txt --no-sign-request

# Delete access
aws s3 rm s3://target-bucket/test.txt --no-sign-request

# Bucket takeover (if CNAME points to non-existent bucket)
aws s3api create-bucket --bucket deleted-bucket-still-cnamed

GCP Cloud Storage

# Check public access
gsutil ls gs://target-bucket
gsutil cat gs://target-bucket/sensitive-file.txt

# Check permissions
gsutil iam get gs://target-bucket

Azure Blob Storage

# Public containers
az storage blob list --container-name target-container \
  --account-name target --auth-mode anonymous

# URL pattern: https://account.blob.core.windows.net/container/blob

Tools

S3Scanner
lazys3
bucket-finder
GrayhatWarfare — public bucket search engine

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free