S3 Bucket

Scripts and tips for securing S3 Buckets

Validating S3 access

# === SETUP ===
# pip install boto3
# 
# === USAGE ===
# python3 s3-bucket.py https://web-faventia.s3-eu-west-1.amazonaws.com

import boto3
from botocore import UNSIGNED
from botocore.client import Config
import sys
import os

BUCKET_URL = sys.argv[1]
BUCKET_NAME = BUCKET_URL.split("//")[1].split(".")[0]

print(f"Checking bucket {BUCKET_NAME} ({BUCKET_URL})")

s3 = boto3.resource('s3', config=Config(signature_version=UNSIGNED))
s3_client = boto3.client('s3', config=Config(signature_version=UNSIGNED))
bucket = s3.Bucket(BUCKET_NAME)


def get_info():
    try:
        bucket_acl = s3_client.get_bucket_acl(Bucket=BUCKET_NAME)
        print(f'[*] Bucket ACL: {bucket_acl}')
    except Exception as err:
        print(f'[-] Error get_info: {err}')


def check_for_public_read():
    try:
        is_public_for_read = False
        for obj in bucket.objects.all():
            print(f'[+] Bucket has files (ex: {obj.key})')
            is_public_for_read = True
            break
            
        if is_public_for_read:
            print("[+] Bucket has public listing")
        else:
            print("[-] Bucket as no public listing")
    except Exception as err:
        print("[-] Bucket as no public listing")
        print(f"[-] Error: {err}")


def check_for_public_write():
    hack_file_path = f"{os.path.dirname(os.path.abspath(__file__))}/data/hacked.txt"
    with open(hack_file_path, "rb") as f:
        try:
            hack_object_name = "b424fa4f-95d3-4375-bf91-b78e4173b0f1.txt"
            s3_client.upload_fileobj(f, BUCKET_NAME, hack_object_name)
            print('[+] Bucket is public for write')
            print(f'[+] File {hack_object_name} uploaded: {BUCKET_URL}/{hack_object_name}')
        except Exception as err:
            print('[-] Bucket is not public for write')
            print(f'[-] Error: {err}')

get_info()
check_for_public_read()
check_for_public_write()

Sample Output:

PreviousLocal web serverNextJWT

Last updated

Was this helpful?