# S3Crets Scanner | Hunting For Secrets Uploaded To Public S3 Buckets

**URL:** <https://onehack.st/t/s3crets-scanner-hunting-for-secrets-uploaded-to-public-s3-buckets/230208>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [December 23, 2022, 8:45pm UTC](https://onehack.st/t/s3crets-scanner-hunting-for-secrets-uploaded-to-public-s3-buckets/230208 "2022-12-23T20:45:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [December 23, 2022, 8:45pm UTC](https://onehack.st/t/s3crets-scanner-hunting-for-secrets-uploaded-to-public-s3-buckets/230208/1 "2022-12-23T20:45:26Z")

</div>

[![](https://github.com/Eilonh/s3crets_scanner/raw/main/DOCS/logo.png)](https://github.com/Eilonh/s3crets_scanner/blob/main/DOCS/logo.png)

- `S3cret Scanner` tool designed to provide a complementary layer for the [Amazon S3 Security Best Practices](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html) by proactively hunting secrets in public S3 buckets.
- Can be executed as `scheduled task` or `On-Demand`

* * *

## Automation workflow

The automation will perform the following actions:

1. List the public buckets in the account (Set with ACL of `Public` or `objects can be public`)
2. List the textual or sensitive files (i.e. `.p12`, `.pgp` and more)
3. Download, scan (using truffleHog3) and delete the files from disk, once done evaluating, one by one.
4. The logs will be created in `logger.log` file.

* * *

## Prerequisites

1. Python 3.6 or above
2. TruffleHog3 installed in $PATH
3. An AWS role with the following permissions:

{ “Version”: “2012-10-17”, “Statement”: [{ “Sid”: “VisualEditor0”, “Effect”: “Allow”, “Action”: [ “s3:GetLifecycleConfiguration”, “s3:GetBucketTagging”, “s3:ListBucket”, “s3:GetAccelerateConfiguration”, “s3:GetBucketPolicy”, “s3:GetBucketPublicAccessBlock”, “s3:GetBucketPolicyStatus”, “s3:GetBucketAcl”, “s3:GetBucketLocation”], “Resource”: “arn:aws:s3:::_" }, { “Sid”: “VisualEditor1”, “Effect”: “Allow”, “Action”: “s3:ListAllMyBuckets”, “Resource”: "_” } ] }

1. If you’re using a CSV file - make sure to place the file `accounts.csv` in the `csv` directory, in the following format:

```auto
Account name,Account id
prod,123456789
ci,321654987
dev,148739578

```

* * *

## Getting started

Use [pip](https://pip.pypa.io/en/stable/) to install the needed requirements.

# Clone the repo git clone # Install requirements pip3 install -r requirements.txt # Install trufflehog3 pip3 install trufflehog3

* * *

## Usage

| Argument | Values | Description | Required |
| --- | --- | --- | --- |
| -p, --aws\_profile | | The aws profile name for the access keys | ✓ |
| -r, --scanner\_role | | The aws scanner’s role name | ✓ |
| -m, --method | internal | the scan type | ✓ |
| -l, --last\_modified | 1-365 | Number of days to scan since the file was last modified; _Default - 1_ | ✗ |

### Usage Examples

## `python3 main.py -p secTeam -r secteam-inspect-s3-buckets -l 1`

## Demo

[![](https://github.com/Eilonh/s3crets_scanner/raw/main/DOCS/scanner_gif.gif)](https://github.com/Eilonh/s3crets_scanner/blob/main/DOCS/scanner_gif.gif)

* * *

## References

[![Medium](https://camo.githubusercontent.com/031158fe406368e77048939080cdd7894ea1e98b230681dffa5c9b081e507194/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d656469756d2d3132313030453f7374796c653d666f722d7468652d6261646765266c6f676f3d6d656469756d266c6f676f436f6c6f723d7768697465)](https://medium.com/@hareleilon/hunting-after-secrets-accidentally-uploaded-to-public-s3-buckets-7e5bbbb80097)

* * *

## Contributing

Pull requests and forks are welcome. For major changes, please open an issue first to discuss what you would like to change.

* * *

## License

[![License](https://camo.githubusercontent.com/684b80de8a7f9f15265f05513c5a770c2051df7278a2376368d2b489eba3efcc/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4170616368655f322e302d626c75652e737667)](https://opensource.org/licenses/Apache-2.0)

## GitHub:

[https://github.com/Eilonh/s3crets\_scanner](https://github.com/Eilonh/s3crets_scanner)