Kali Linux

S3Crets Scanner : Hunting For Secrets Uploaded To Public S3 Buckets

S3cret Scanner tool designed to provide a complementary layer for the Amazon S3 Security Best Practices by proactively hunting secrets in public S3 buckets.

Can be executed as scheduled task or On-Demand.

Automation Workflow

The automation will perform the following actions:

List the public buckets in the account (Set with ACL of Public or objects can be public)
List the textual or sensitive files (i.e. .p12, .pgp and more)
Download, scan (using truffleHog3) and delete the files from disk, once done evaluating, one by one.
The logs will be created in logger.log file.

Prerequisites

  1. Python 3.6 or above
  2. TruffleHog3 installed in $PATH
  3. An AWS role with the following permissions:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetLifecycleConfiguration",
                "s3:GetBucketTagging",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketAcl",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}
  1. If you’re using a CSV file – make sure to place the file accounts.csv in the csv directory, in the following format:
Account name,Account id
prod,123456789
ci,321654987
dev,148739578

Getting Started

Use pip to install the needed requirements.

# Clone the repo
git clone <repo>
# Install requirements
pip3 install -r requirements.txt
# Install trufflehog3
pip3 install trufflehog3

Usage

ArgumentValuesDescriptionRequired
-p, –aws_profileThe aws profile name for the access keys
-r, –scanner_roleThe aws scanner’s role name
-m, –methodinternalthe scan type
-l, –last_modified1-365Number of days to scan since the file was last modified; Default – 1

Demo

R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

1 week ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

1 week ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

1 week ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

1 week ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

2 weeks ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

2 weeks ago