Sandcastle : A Python Script For AWS S3 Bucket Enumeration

Inspired by a conversation with Instacart’s @nickelser on HackerOne, I’ve optimized and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler.

The script takes a target’s name as the stem argument (e.g. shopify) and iterates through a file of bucket name permutations, such as the ones below:

-training
-bucket
-dev
-attachments
-photos
-elasticsearch […]

Getting Started

  • Here’s how to get started:
    • Clone this repo (PyPi distribution temporarily disabled).
    • Run sandcastle.py with a target name and input file (grab an example from this repo)
    • Matching bucket permutations will be identified, and read permissions tested.

Usage: sandcastle.py [-h] -t targetStem [-f inputFile]
Arguments:
-h, –help show this help message and exit
-t targetStem, –target targetStem
Select a target stem name (e.g. ‘shopify’)
-f inputFile, –file inputFile
Select a bucket permutation file (default: bucket-
names.txt)

>>S3 bucket enumeration // release v1.2.4 // ysx
>>[*] Commencing enumeration of ‘shopify’, reading 138 lines from ‘bucket-names.txt’.
>>[+] Checking potential match: shopify-content –> 403
>>An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

Also Read – MSSQLi-DUET : MSSQL Injection-based Domain User Enumeration Tool

Status Codes & Testing

Status codeDefinitionNotes
404Bucket Not FoundNot a target for analysis (hidden by default)
403Access DeniedPotential target for analysis via the CLI
200Publicly AccessiblePotential target for analysis via the CLI

AWS CLI Commands

Here’s a quick reference of some useful AWS CLI commands:

  • List Files: aws s3 ls s3://bucket-name
  • Download Files: aws s3 cp s3://bucket-name/<file> <destination>
  • Upload Files: aws s3 cp/mv test-file.txt s3://bucket-name
  • Remove Files: aws s3 rm s3://bucket-name/test-file.txt

What is S3?

  • From the Amazon documentation, Working with Amazon S3 Buckets:
  • Amazon S3 [Simple Storage Service] is cloud storage for the Internet. To upload your data (photos, videos, documents etc.), you first create a bucket in one of the AWS Regions. You can then upload any number of objects to the bucket.
  • In terms of implementation, buckets and objects are resources, and Amazon S3 provides APIs for you to manage them.

Closing Remarks

  • This is my first public security project. Sandcastle is published under the MIT License.
  • Usage acknowledgements:
    • Castle (icon) by Andrew Doane from the Noun Project
    • Nixie One (logo typeface) free by Jovanny Lemonad
R K

Recent Posts

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

21 hours ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

1 day ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

1 day ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

1 day ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

1 day ago

How to Create Directories in Linux with the mkdir Command

Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…

1 day ago