Amazon S3 proofs

Question

Amazon S3 proofs

PatrikHudak opened this issue 6 years ago · comments

Service name

Amazon (AWS) S3

Proof

Amazon S3 service is indeed vulnerable. Amazon S3 follows pretty much the same concept of virtual hosting as other cloud providers. S3 buckets might be configured as website hosting to serve static content as web servers. If the canonical domain name has website in it, the S3 bucket is specified as Website hosting. I suspect that non-website and website configured buckets are handled by separate load balancers, and therefore they don't work with each other. The only difference will be in the bucket creation where correct website flag needs to be set if necessary. Step-by-step process:

Go to S3 panel
Click Create Bucket
Set Bucket name to source domain name (i.e., the domain you want to take over)
Click Next multiple times to finish
Open the created bucket
Click Upload
Select the file which will be used for PoC (HTML or TXT file). I recommend naming it differently than index.html; you can use poc (without extension)
In Permissions tab select Grant public read access to this object(s)
After upload, select the file and click More -> Change metadata
Click Add metadata, select Content-Type and value should reflect the type of document. If HTML, choose text/html, etc.
(Optional) If the bucket was configured as a website
1. Switch to Properties tab
2. Click Static website hosting
3. Select Use this bucket to host a website
4. As an index, choose the file that you uploaded
5. Click Save

To verify the domain, I run:

http -b GET http://{SOURCE DOMAIN NAME} | grep -E -q '<Code>NoSuchBucket</Code>|<li>Code: NoSuchBucket</li>' && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible"

Note that there are two possible error pages depending on the bucket settings (set as website hosting or not).

Some reports on H1, claiming S3 buckets:

Documentation

There are several formats of domains that Amazon uses for S3 (RegExp):

^[a-z0-9\.\-]{0,63}\.?s3.amazonaws\.com$
^[a-z0-9\.\-]{0,63}\.?s3-website[\.-](eu|ap|us|ca|sa|cn)-\w{2,14}-\d{1,2}\.amazonaws.com(\.cn)?$
^[a-z0-9\.\-]{0,63}\.?s3[\.-](eu|ap|us|ca|sa)-\w{2,14}-\d{1,2}\.amazonaws.com$
^[a-z0-9\.\-]{0,63}\.?s3.dualstack\.(eu|ap|us|ca|sa)-\w{2,14}-\d{1,2}\.amazonaws.com$

Note that there are cases where only raw domain (e.g. s3.amazon.com) is included in CNAME and takeover is still possible.

(Documentation taken from https://0xpatrik.com/takeover-proofs/)

Patrik Hudák · Answer 1 · Sun Sep 16 2018 03:02:59 GMT+0800 (China Standard Time)

Official documentation link: https://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html

sumgr0 · Answer 2 · Fri Mar 15 2019 00:03:58 GMT+0800 (China Standard Time)

I've come across a sub-domain which confirms the error message:

NoSuchBucket
The specified bucket does not exist
randombucket-assets

When use the dig command, the CNAME points to a random.cloudfront.net URL.

On trying to follow the above steps, getting below message while creating the S3 bucket with same name:
"Bucket name already exists"

I'm entering the full sub-domain name in the bucket name. Am I missing something to check?

Update: I've been able to find the S3 bucket URL: subdomain.s3.amazonaws.com

soynek · Answer 3 · Tue Jul 09 2019 16:13:47 GMT+0800 (China Standard Time)

id 64053
opcode QUERY
rcode NOERROR
flags QR RD RA
;QUESTION
girishsarwal.me. IN CNAME
;ANSWER
;AUTHORITY
something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
;ADDITIONAL

in s3 bucket, i'm facing this problem. What's solution for this ?

Michael Skelton · Answer 4 · Tue Jul 09 2019 19:05:30 GMT+0800 (China Standard Time)

@soynek You're going to need to dig into the documentation for this one, we've had to draw the line at this repository being treated like a support desk. This is here to outline the work people have contributed back, and to outline vulnerable areas, but if you have a specific subdomain takeover question then the documentation for that service is where you should be looking.

soynek · Answer 5 · Wed Jul 10 2019 02:24:51 GMT+0800 (China Standard Time)

@codingo
I want to takeover a subdomain and i face that problem as in picture showing. Any solution for this?

Anish Khatri · Answer 6 · Sun Feb 23 2020 18:39:15 GMT+0800 (China Standard Time)

Hi
I found a domain with CNAME *.cloudfront.net
When I access it from browser it returned empty. I tried to add it to bucket by steps above and was successfully added. But when I access it, it's still empty, I tried other subdomains from same domain but they say 'Bucket name already exist'.
Please explain me this

Patrik Hudák · Answer 7 · Sun Feb 23 2020 20:07:19 GMT+0800 (China Standard Time)

@yoursquad13 Because *.cloudfront.net is not a subdomain for S3

nynuz · Answer 8 · Wed Feb 26 2020 23:26:48 GMT+0800 (China Standard Time)

Hi, during a bug bounty activity I have found a subdomain vulnerable to takeover, the dig command returns this information:
sub.example.com CNAME [bucket_name].s3.amazonaws.com
and then:
[bucket_name].s3.amazonaws.com CNAME s3-1-w.amazonaws.com
I haven't the region information from dig command.

Also if I visit the page, I get an XML error. Below is the screenshot:

The subdomain would seem vulnerable to takeover, but when I go to create the bucket from my AWS console, I get the following error:
Bucket name already exists

Anyone can help me?
Thank You!

Noah · Answer 9 · Tue May 05 2020 00:36:01 GMT+0800 (China Standard Time)

@webliqui
Any news on this issue? I am running into the same thing

Wallace Soares · Answer 10 · Tue May 05 2020 02:36:18 GMT+0800 (China Standard Time)

Have you guys ran the AWS CLI like aws s3 ls <bucket_name>? I think this command search in all regions for a bucket name.

Keshav Malik · Answer 11 · Tue May 05 2020 19:49:16 GMT+0800 (China Standard Time)

@webliqui You found something?
I'm facing the same issue.
@codingo Do you have some solution for this?

Zachswan1 · Answer 12 · Fri Jun 19 2020 14:30:01 GMT+0800 (China Standard Time)

same issue as @webliqui. @codingo?

Wallace Soares · Answer 13 · Wed Jun 24 2020 06:16:48 GMT+0800 (China Standard Time)

I believe, as I mentioned above, this issue is related to the region. This bucket may not be created on the region that you are testing on. But if you use the AWS CLI (aws s3 ls <bucket_name>) I believe you would find the bucket. I suggest you to test using the AWS CLI.

Michele Romano · Answer 14 · Sun Jul 05 2020 18:14:43 GMT+0800 (China Standard Time)

Hi @soareswallace :),
I got the same error and when I execute the command you suggested in the latest reply, I get this error: An error occurred (AllAccessDisabled) when calling the ListObjectsV2 operation: All access to this object has been disabled ... any tip to make possible the take over ?

Regards,
Mik

Wallace Soares · Answer 15 · Fri Jul 10 2020 02:49:20 GMT+0800 (China Standard Time)

I believe when we get this message @Mik317 , the take over is not possible. This message show that the bucket does exist and has an owner.

Stay safe,

Wallace

Michele Romano · Answer 16 · Fri Jul 10 2020 02:55:37 GMT+0800 (China Standard Time)

Hi @soareswallace :).
Thanks for the reply. I'll be lucky the next time ;)

Until that, stay safe and hack the world ;)

Regards,
Mik

Faizan Nehal · Answer 17 · Wed Jul 15 2020 23:47:21 GMT+0800 (China Standard Time)

Hi @soareswallace
I discovered a subdomain whose CNAME is point to *.elb.amazonaws.com.
How can I takeover this subdomain? Is the process same as creating a s3 bucket?

Wallace Soares · Answer 18 · Thu Jul 16 2020 00:34:48 GMT+0800 (China Standard Time)

Hi @FaizanNehal,

I tried once, but never found out how to do it. I also would like to know how we can takeover. Let us know if you discover anything.

Wallace

vemoa · Answer 19 · Tue Jul 21 2020 14:45:36 GMT+0800 (China Standard Time)

Anyone knows about amazon route 53???? Is it vulnerable?

Peter · Answer 20 · Wed Aug 05 2020 00:31:00 GMT+0800 (China Standard Time)

I found a subdomain.domain.com that is vulnerable, and confirmed with dig that CNAME was for s3 bucket in Verginia
When I tried creating the bucket with the same name it worked but the endpoint for the bucket was like so:
^[a-z0-9\.\-]{0,63}\.?s3-website[\.-](eu|ap|us|ca|sa|cn)-\w{2,14}-\d{1,2}\.amazonaws.com(\.cn)?$
Which is mentioned in the documentation. OR
^[a-z0-9\.\-]{0,63}\.?s3.amazonaws\.com$/subdomain.domain.com/
Which is not.

my question is since it is not mentioned in the steps above how to make those regexes point to subdomain.domain.com?

@gdattacker · Answer 21 · Sat Sep 05 2020 00:41:24 GMT+0800 (China Standard Time)

is this service still vulnerable?

Philippe Delteil · Answer 22 · Thu Sep 24 2020 03:05:28 GMT+0800 (China Standard Time)

Hi @soareswallace
I discovered a subdomain whose CNAME is point to *.elb.amazonaws.com.
How can I takeover this subdomain? Is the process same as creating a s3 bucket?

Not really, usually before the elb there's a random number.

anantupadhya · Answer 23 · Fri Sep 25 2020 13:23:28 GMT+0800 (China Standard Time)

Hi,
I have found "The specified bucket does not exist" for few subdomains. But when I do a dig, the subdomains fail to give a CNAME record. So does it mean that they are not vulnerable. Or am I missing something here?

Empty Mind · Answer 24 · Fri Mar 19 2021 00:28:13 GMT+0800 (China Standard Time)

Hi @soareswallace
I discovered a subdomain whose CNAME is point to *.elb.amazonaws.com.
How can I takeover this subdomain? Is the process same as creating a s3 bucket?

did u find any info about it?

Wallace Soares · Answer 25 · Fri Mar 19 2021 00:32:32 GMT+0800 (China Standard Time)

So far, from what I could search about it, is not possibly to take over amazon's load balance.

Wallace Soares · Answer 26 · Fri Mar 19 2021 00:33:38 GMT+0800 (China Standard Time)

And as @pdelteil replied above:

Not really, usually before the elb there's a random number.

Empty Mind · Answer 27 · Fri Mar 19 2021 00:37:04 GMT+0800 (China Standard Time)

okey , thanks

@gdattacker · Answer 28 · Sun May 23 2021 21:56:44 GMT+0800 (China Standard Time)

id 64053
opcode QUERY
rcode NOERROR
flags QR RD RA
;QUESTION
girishsarwal.me. IN CNAME
;ANSWER
;AUTHORITY
something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
;ADDITIONAL

in s3 bucket, i'm facing this problem. What's solution for this ?

in this case i try to create bucket by deleteing at recreating it ofcourse it take time but work it.

BugMania · Answer 29 · Wed Aug 25 2021 18:46:44 GMT+0800 (China Standard Time)

@technicaljunkie which kind?

Sim4n6 · Answer 30 · Fri Nov 05 2021 01:32:30 GMT+0800 (China Standard Time)

Hi,

I've got the fingerprint The specified bucket does not exist However, when I dig for dns records using dig +nocmd +noall +answer CNAME sub.domain.com I get nothing on CNAME record ?

Does it mean some measures have already been taken ? can I take it over ?

Thank you in advance

@gdattacker · Answer 31 · Fri Nov 05 2021 01:34:25 GMT+0800 (China Standard Time)

Try ping to know region and in case of subdomain not necessary you usually see them clear when firewall being used

Sim4n6 · Answer 32 · Fri Nov 05 2021 04:17:57 GMT+0800 (China Standard Time)

Do you mean traceroute?

@gdattacker · Answer 33 · Fri Nov 05 2021 04:19:16 GMT+0800 (China Standard Time)

@Sim4n6 no i mean ping sub.site.com

Sim4n6 · Answer 34 · Fri Nov 05 2021 14:55:22 GMT+0800 (China Standard Time)

Well, either dig or ping got me the IP address. And it is located in Zurich. Now the question is the bucket name is unknown.

Sim4n6 · Answer 35 · Fri Nov 05 2021 14:56:56 GMT+0800 (China Standard Time)

CNAME of sub.domain.com does not show a domain of format ^[a-z0-9.-]{0,63}.?s3.amazonaws.com$

But curl -v does return the fingerprint.

Sim4n6 · Answer 36 · Mon Nov 08 2021 22:15:09 GMT+0800 (China Standard Time)

I've got the bucket name, so unfortunate the name is already taken 😕😕

@gdattacker · Answer 37 · Thu Jan 13 2022 23:08:47 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL

in s3 bucket, i'm facing this problem. What's solution for this ?

Got this errror solved in some of my takeovers

Akshay Ravi · Answer 38 · Fri Apr 08 2022 23:00:55 GMT+0800 (China Standard Time)

I was checking for subdomain takeover and got a s3 bucket which doesn't exists and confirmed the takeover vulnerability with subzy, but the problem is im not able to create bucket with the vulnerable domain name, its says, Bucket with the same name already exists, so how to takeover this bucket??

BugMania · Answer 39 · Fri Apr 08 2022 23:31:42 GMT+0800 (China Standard Time)

I was checking for subdomain takeover and got a s3 bucket which doesn't exists and confirmed the takeover vulnerability with subzy, but the problem is im not able to create bucket with the vulnerable domain name, its says, Bucket with the same name already exists, so how to takeover this bucket??

It can possibly be a honeypot i saw same during one target else confirm you are entering bucket name because sometimes it's not same as host url

Finlay · Answer 40 · Sun May 29 2022 01:51:07 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL

in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

@gdattacker · Answer 41 · Sun May 29 2022 01:58:06 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

Bucket region mismatch change region

@gdattacker · Answer 42 · Sun May 29 2022 02:00:24 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

Finlay · Answer 43 · Sun May 29 2022 03:19:04 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

Bucket region mismatch change region

@GDATTACKER-RESEARCHER how can you find out which one you need to change to out of the 22 options?

@gdattacker · Answer 44 · Sun May 29 2022 03:21:10 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

Bucket region mismatch change region

@GDATTACKER-RESEARCHER how can you find out which one you need to change to out of the 22 options?

Different ways depend on case by case bases by ping, other buckets in use by site, cname etc

SAGEof6iixPATHS · Answer 45 · Sat Jul 16 2022 16:16:37 GMT+0800 (China Standard Time)

Is this vulnerable?
asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

@gdattacker · Answer 46 · Sat Jul 16 2022 16:26:13 GMT+0800 (China Standard Time)

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Yes

SAGEof6iixPATHS · Answer 47 · Sat Jul 16 2022 16:36:12 GMT+0800 (China Standard Time)

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Yes

Have you tried?

@gdattacker · Answer 48 · Sat Jul 16 2022 17:37:23 GMT+0800 (China Standard Time)

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Yes

Have you tried?

🤣😂 nice question i still hai 15 buckets claimed i guess

SAGEof6iixPATHS · Answer 49 · Sat Jul 16 2022 17:39:09 GMT+0800 (China Standard Time)

Is this vulnerable? asdasd.target.com shows this
<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>
And DIG shows this:
target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.
* - Stars are in the place of some numbers
Yes
Have you tried?
🤣😂 nice question i still hai 15 buckets claimed i guess

Good for you, thanks for the help!!

Philippe Delteil · Answer 50 · Fri Nov 18 2022 01:23:50 GMT+0800 (China Standard Time)

Hello everyone,

I can confirm this takeover is still possible, adding some details:

If you get an error as 'the bucket .... already exists' --> it's not vulnerable.
A CNAME pointing to a AWS domain name is not necessary. I took a bucket that was pointing to several IP addresses. The relevant part is the response fingerprint.
The error with Code: IncorrectEndpoint can be fixed removing and creating the bucket in another region. It takes around 1 hour for the bucket to be removed, before that you won't be able to create it. Use AWS Cli to automate this part.
If you are getting Access denied errors, check this guide

radiustama77 · Answer 51 · Sun Dec 11 2022 14:31:15 GMT+0800 (China Standard Time)

Hello everyone,

I can confirm this takeover is still possible, adding some details:

If you get an error as 'the bucket .... already exists' --> it's not vulnerable.

A CNAME pointing to a AWS domain name is not necessary. I took a bucket that was pointing to several IP addresses. The relevant part is the response fingerprint.

The error with Code: IncorrectEndpoint can be fixed removing and creating the bucket in another region. It takes around 1 hour for the bucket to be removed, before that you won't be able to create it. Use AWS Cli to automate this part.

If you are getting Access denied errors, check this guide

i try to take subdomain from s3 bucket, if i try access subdomain ex : sub.domain.com always return error 403. but if i access sub.domain.com/index.html it can be open normally. whats the problem?

Filip Jelić · Answer 52 · Sun Dec 11 2022 18:17:39 GMT+0800 (China Standard Time)

@radiustama77 AWS has very granular permission controls. Opening sub.domain.com/ needs s3:ListBucket permission which you don't have. However, you do have permission to s3:GetObject so if you can guess the name of the file, you will be able to get it.
Based on the behavior you described, subdomain takeover is not possible. Also, it seems that bucket files are intended to be public based on 'index.html' filename implications. You may try brute-forcing for filenames and see if you get something sensitive (with gobuster for example).

radiustama77 · Answer 53 · Fri Dec 16 2022 14:10:13 GMT+0800 (China Standard Time)

@radiustama77 AWS has very granular permission controls. Opening sub.domain.com/ needs s3:ListBucket permission which you don't have. However, you do have permission to s3:GetObject so if you can guess the name of the file, you will be able to get it. Based on the behavior you described, subdomain takeover is not possible. Also, it seems that bucket files are intended to be public based on 'index.html' filename implications. You may try brute-forcing for filenames and see if you get something sensitive (with gobuster for example).

what i mean is, i already can takeover several subdomain. but for some subdomain, whenever i try to access with subdomain.example.com it return to error 403 access denied. But if i access it with subdomain.example.com/index.html it works and normal.

@gdattacker · Answer 54 · Fri Dec 16 2022 14:45:35 GMT+0800 (China Standard Time)

@radiustama77 AWS has very granular permission controls. Opening sub.domain.com/ needs s3:ListBucket permission which you don't have. However, you do have permission to s3:GetObject so if you can guess the name of the file, you will be able to get it. Based on the behavior you described, subdomain takeover is not possible. Also, it seems that bucket files are intended to be public based on 'index.html' filename implications. You may try brute-forcing for filenames and see if you get something sensitive (with gobuster for example).

what i mean is, i already can takeover several subdomain. but for some subdomain, whenever i try to access with subdomain.example.com it return to error 403 access denied. But if i access it with subdomain.example.com/index.html it works and normal.

That's because you have not specified index files in static hosting which you need to for index page. Else it keep coming up with error 403

radiustama77 · Answer 55 · Fri Dec 16 2022 15:49:14 GMT+0800 (China Standard Time)

@GDATTACKER-RESEARCHER I already specified the index file in static hosting.
the url from s3 amazon work properly too like subdomain.s3-website-us-east-1.amazonaws.com but error still happened when i try to access via subdomain.example.com

Prabin Sigdel · Answer 56 · Sat Feb 25 2023 18:01:27 GMT+0800 (China Standard Time)

It means that the ,bucket is not available for takeovers.

@gdattacker · Answer 57 · Sat Feb 25 2023 18:06:22 GMT+0800 (China Standard Time)

It means that the ,bucket is not available for takeovers.

Yes it is not possible to claim this one as it's already in use just the permissions for static hosting has been disabled

T10 · Answer 58 · Wed Mar 01 2023 22:54:42 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

how to know the region?

BugMania · Answer 59 · Wed Mar 01 2023 23:06:31 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

how to know the region?

simply change the region to us-west-2 in your case for domain girishsarwal.me

T10 · Answer 60 · Wed Mar 01 2023 23:09:21 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

T10 · Answer 61 · Wed Mar 01 2023 23:11:14 GMT+0800 (China Standard Time)

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL
in s3 bucket, i'm facing this problem. What's solution for this ?

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

how to know the region?

simply change the region to us-west-2 in your case for domain girishsarwal.me

like in this how i can get the correct region to create a bucket with this domains

BugMania · Answer 62 · Wed Mar 01 2023 23:11:48 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

T10 · Answer 63 · Wed Mar 01 2023 23:12:45 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

what the common methods? to get the region

BugMania · Answer 64 · Wed Mar 01 2023 23:13:45 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

T10 · Answer 65 · Thu Mar 02 2023 07:25:47 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

i check the ip for my site with the ping , and then use method like you do to check ip ranges in the amazon prefix but didnt found how i can get the region ? if the ip not avalaibe in that data you send

@gdattacker · Answer 66 · Thu Mar 02 2023 09:49:48 GMT+0800 (China Standard Time)

Using other bucket used by websites's default location, using the ip ranges of bucket, use aws-cli to know region etc

@gdattacker · Answer 67 · Thu Mar 02 2023 09:51:22 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

i check the ip for my site with the ping , and then use method like you do to check ip ranges in the amazon prefix but didnt found how i can get the region ? if the ip not avalaibe in that data you send

Ip range is available if you know networking you should know easily your ip range is mentioned there.

T10 · Answer 68 · Thu Mar 02 2023 10:43:19 GMT+0800 (China Standard Time)

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

i check the ip for my site with the ping , and then use method like you do to check ip ranges in the amazon prefix but didnt found how i can get the region ? if the ip not avalaibe in that data you send

Ip range is available if you know networking you should know easily your ip range is mentioned there.

example this endpass.com this i lookup ip
and got 104.21.37.171 after that i check in iprange prefix amazon but still didnt find , can you give advice?

BugMania · Answer 69 · Thu Mar 02 2023 10:53:17 GMT+0800 (China Standard Time)

why you need script for it when you can do manually.

4nibhal · Answer 70 · Sun Sep 17 2023 01:00:12 GMT+0800 (China Standard Time)

Hi guys, is this still vulnerable?
I get an error that the bucket name is already taken.🤔

six2dez · Answer 71 · Thu Nov 02 2023 18:07:52 GMT+0800 (China Standard Time)

Hi guys I found the following scenario:

subdomain.example.com returning NoSuchBucket
dig cname subdomain.example.com returns:

> dig cname subdomain.example.com                                                                   

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> cname subdomain.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43658
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;subdomain.example.com.	IN	CNAME

;; ANSWER SECTION:
subdomain.example.com. 3600 IN	CNAME	RANDOM_NAME_SEQUENCE.s3.amazonaws.com.

;; Query time: 31 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Thu Nov 02 10:55:24 CET 2023
;; MSG SIZE  rcvd: 131

Checked bucket region by curl -sI RANDOM_NAME_SEQUENCE.s3.amazonaws.com | grep bucket-region
Claimed and created an S3 bucket with the name RANDOM_NAME_SEQUENCE.s3.amazonaws.com on the region from the previous step and uploaded a poc to RANDOM_NAME_SEQUENCE.s3.amazonaws.com/poc, made it public, both the bucket and the poc file.
Navigated to https://RANDOM_NAME_SEQUENCE.s3.amazonaws.com/poc and the file shows properly.
subdomain.example.com/poc still shows NoSuchBucket.

Also tried the to create the bucket as static website hosting. Does anyone found this scenario or know what's happening here?

Jai Kandepu · Answer 72 · Thu Nov 02 2023 19:28:27 GMT+0800 (China Standard Time)

@six2dez please refer to this issue #361 I have faced similar kind of scenario hope it will be useful

cyberduck404 · Answer 73 · Sat Dec 30 2023 16:04:12 GMT+0800 (China Standard Time)

Bucket with the same name already exists

Is this edge case now?

@gdattacker · Answer 74 · Sat Dec 30 2023 16:08:07 GMT+0800 (China Standard Time)

Bucket with the same name already exists
Is this edge case now?

No