Amazon S3 Buckets

To enumerate S3 buckets, we can just enter the URL in the browser. A private bucket will respond with "Access Denied" while a public bucket will list the first 1000 objects that have been stored.

An example will be the following link (link defang):

http[://]cddc-cloud-ctf-8aa200468596d003.s3-ap-southeast-1[.]amazonaws.com/

Navigating to it will provide us with a XML list of the pages we can access.

If there is a website within the link, we can simply remove it (links defang):

http[://]cddc-cloud-ctf-8aa200468596d003.s3-website-ap-southeast-1.amazonaws[.]com/

Remove -website:

http[://]cddc-cloud-ctf-8aa200468596d003.s3-ap-southeast-1[.]amazonaws.com/

In this example, there is a API within the source code of the page.

Navigating to that link and changing the bucket name to one of the ones we found in the XML list, we can access content that we are otherwise not supposed to.

An example will be trying to access the flagbucket-8aa200468596d003 page (link defang):

https[://]mvh9pjewz7.execute-api.ap-southeast-1.amazonaws[.]com/callLambda/resorce?bucket_name=flagbucket-8aa200468596d003

We can see that we are able to navigate to the flagbucket page.