Bucky : An Automatic S3 Bucket Discovery Tool

Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular Expression(Regex) to match the S3 bucket used as Content Delivery Network(CDN) and sends it to the Bucky Backend engine. The backend engine receives the data from addon and checks if the S3 bucket is publicly writeable or not. Bucky automatically uploads a text file as Proof Of Concept(PoC) if the bucket is vulnerable.

Working

Bucky addon sends the details of s3 bucket name discovered from a user visited web pages to backend engine. It uses AWS PHP SDK to discover misconfiguration. Users can also check for S3 bucket misconfiguration manually. All the results from automatic and manuall check are populated to dashboard.

Installation

git clone https://github.com/smaranchand/bucky.git
cd bucky

Requirements: AWS Access Keys and PHP installation

Get AWS Access Keys: https://console.aws.amazon.com/iam/home?#/security_credentials

PHP installation: Install according to your OS, apt install php7.3 / brew install php7.3

Currently, Bucky addon is not published in the Firefox addon store; as soon as the addon will be published, the addon link will be provided.

For now, users can manually load the addon into the browser to do so

  1. Open Firefox browser and visit about:debugging
  2. Click on “This Firefox” > Load Temporary Add-on
  3. Select the addon located at bucky/addon/bucky.js

Add AWS Access keys:

cd bucky/
nano config.inc.php
Add your AWS Access Key ID and Secret Access Key. (On-Line 57 and 61)

Usage

To use Bucky, load the Bucky addon to the browser and start backend engine.

cd bucky/
chmod +x run.sh
./run.sh
The backend engine runs on http://127.0.0.1:13337
Browse websites, Bucky will discover S3 buckets automatically and will be reflected in the dashboard.
Visit the above address to access Bucky dashboard.

Screenshots

Running Bucky

Loading Addon

User Interface

All Buckets

Manual Check

POC By Bucky

R K

Recent Posts

Starship : Revolutionizing Terminal Experiences Across Shells

Starship is a powerful, minimal, and highly customizable cross-shell prompt designed to enhance the terminal…

21 hours ago

Lemmy : A Decentralized Link Aggregator And Forum For The Fediverse

Lemmy is an innovative, open-source platform designed for link aggregation and discussion, providing a decentralized…

21 hours ago

Massive UX Improvements, Custom Disassemblers, And MSVC Support In ImHex v1.37.0

The latest release of ImHex v1.37.0 introduces a host of exciting features and improvements, enhancing…

23 hours ago

Ghauri : A Powerful SQL Injection Detection And Exploitation Tool

Ghauri is a cutting-edge, cross-platform tool designed to automate the detection and exploitation of SQL…

1 day ago

Writing Tools : Revolutionizing The Art Of Writing

Writing tools have become indispensable for individuals looking to enhance their writing efficiency, accuracy, and…

1 day ago

PatchWerk : A Tool For Cleaning NTDLL Syscall Stubs

PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall…

2 days ago