PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing S3 Bucket Permissions

yeswehack.com | blog | #bug-bounty | #cloud | #cloud-security | #aws | #access-control | #data-exposure | #misconfiguration | #s3
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A guide to abusing misconfigured AWS S3 bucket permissions: how to identify exposed buckets, the access-control mistakes that leak data, and how attackers and bounty hunters exploit them.
Published
Collected

Related coverage

blog · hackenproof.com
New Discovery: Nokia left its cloud environment open, config details exposed
HackenProof disclosed that Nokia left one of its cloud environments open to the internet, exposing configuration details.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · hunt.io
Over 68 GB of Philippine Overseas-Employment Database Backups Copied From an Exposed Staging Server
An exposed staging server at UpCloud revealed a completed 68 GB copy of 27 Philippine overseas-employment database backups, a rebranded GodPotato privilege escalation tool, and the operator's own transfer logs.
blog · netspi.com
Stay Ahead of Cloud Threats: Introducing Azure and AWS Security Reviews
Discover how NetSPI's Azure & AWS Configuration Reviews provide continuous visibility, risk identification, and actionable insights to secure your cloud environments.
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · wiz.io
Setting secure defaults on AWS and avoiding misconfigurations
Wiz's Scott Piper explains enforcing secure AWS defaults with SCPs—blocking public S3 buckets, disabling risky features and protecting the guardrails themselves—with rollout checks.
Back