# S3Scanner | A tool to find open S3 buckets and dump their contents **URL:** \ **Category:** Tools & Scripts\ **Tags:** programming, content-creation\ **Created:** [January 25, 2022, 9:50am UTC](https://onehack.st/t/s3scanner-a-tool-to-find-open-s3-buckets-and-dump-their-contents/212970 "2022-01-25T09:50:22Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [January 25, 2022, 9:50am UTC](https://onehack.st/t/s3scanner-a-tool-to-find-open-s3-buckets-and-dump-their-contents/212970/1 "2022-01-25T09:50:23Z")
![image](https://onehack.st/uploads/default/original/3X/2/d/2dcd2adcc30a24e5763ed57fed4b2fe7c579d57d.png) ## Usage usage: s3scanner [-h] [–version] [–threads n] [–endpoint-url ENDPOINT\_URL] [–endpoint-address-style {path,vhost}] [–insecure] {scan,dump} … s3scanner: Audit unsecured S3 buckets by Dan Salmon - [github.com/sa7mon](http://github.com/sa7mon), @bltjetpack optional arguments: -h, --help show this help message and exit --version Display the current version of this tool --threads n, -t n Number of threads to use. Default: 4 --endpoint-url ENDPOINT\_URL, -u ENDPOINT\_URL URL of S3-compliant API. Default: [https://s3.amazonaws.com](https://s3.amazonaws.com) --endpoint-address-style {path,vhost}, -s {path,vhost} Address style to use for the endpoint. Default: path --insecure, -i Do not verify SSL mode: {scan,dump} (Must choose one) scan Scan bucket permissions dump Dump the contents of buckets ## 🚀 Support If you’ve found this tool useful, please consider donating to support its development. You can find sponsor options on the side of this repo page or in [FUNDING.yml](https://github.com/sa7mon/S3Scanner/blob/master/.github/FUNDING.yml) [![](https://user-images.githubusercontent.com/3712226/146481766-a331b010-29c4-4537-ac30-9a4b4aad06b3.png)](https://www.tines.com/?utm_source=oss&utm_medium=sponsorship&utm_campaign=s3scanner) Huge thank you to [tines](https://www.tines.com/?utm_source=oss&utm_medium=sponsorship&utm_campaign=s3scanner) for being an ongoing sponsor of this project. ## Installation pip3 install s3scanner or via Docker: docker build . -t s3scanner:latest docker run --rm s3scanner:latest scan --bucket my-buket or from source: git clone [git@github.com](mailto:git@github.com):sa7mon/S3Scanner.git cd S3Scanner pip3 install -r requirements.txt python3 -m S3Scanner ## Features - ⚡ Multi-threaded scanning - 🔭 Supports tons of S3-compatible APIs - 🕵️‍♀️ Scans all bucket permissions to find misconfigurations - 💾 Dump bucket contents to a local folder - 🐳 Docker support ## Examples - Scan AWS buckets listed in a file with 8 threads $ s3scanner --threads 8 scan --buckets-file ./bucket-names.txt - Scan a bucket in Digital Ocean Spaces $ s3scanner --endpoint-url [https://sfo2.digitaloceanspaces.com](https://sfo2.digitaloceanspaces.com) scan --bucket my-bucket - Dump a single AWS bucket $ s3scanner dump --bucket my-bucket-to-dump - Scan a single Dreamhost Objects bucket which uses the vhost address style and an invalid SSL cert $ s3scanner --endpoint-url [https://objects.dreamhost.com](https://objects.dreamhost.com) --endpoint-address-style vhost --insecure scan --bucket my-bucket ## S3-compatible APIs `S3Scanner` can scan and dump buckets in S3-compatible APIs services other than AWS by using the `--endpoint-url` argument. Depending on the service, you may also need the `--endpoint-address-style` or `--insecure` arguments as well. Some services have different endpoints corresponding to different regions **Note:** `S3Scanner` currently only supports scanning for anonymous user permissions of non-AWS services | Service | Example Endpoint | Address Style | Insecure ? | | --- | --- | --- | --- | | DigitalOcean Spaces (SFO2 region) | [https://sfo2.digitaloceanspaces.com](https://sfo2.digitaloceanspaces.com/) | path | No | | Dreamhost | [https://objects.dreamhost.com](https://objects.dreamhost.com/) | vhost | Yes | | Linode Object Storage (eu-central-1 region) | [https://eu-central-1.linodeobjects.com](https://eu-central-1.linodeobjects.com/) | vhost | No | | Scaleway Object Storage (nl-ams region) | [https://s3.nl-ams.scw.cloud](https://s3.nl-ams.scw.cloud/) | path | No | | Wasabi Cloud Storage | [http://s3.wasabisys.com/](http://s3.wasabisys.com/) | path | Yes | 📚 Current status of non-AWS APIs can be found [in the project wiki](https://github.com/sa7mon/S3Scanner/wiki/S3-Compatible-APIs) ## Interpreting Results This tool will attempt to get all available information about a bucket, but it’s up to you to interpret the results. [Possible permissions](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-bucket-permissions.html) for buckets: - Read - List and view all files - Write - Write files to bucket - Read ACP - Read all Access Control Policies attached to bucket - Write ACP - Write Access Control Policies to bucket - Full Control - All above permissions Any or all of these permissions can be set for the 2 main user groups: - Authenticated Users - Public Users (those without AWS credentials set) - Individual users/groups (out of scope of this tool) **What this means:** Just because a bucket doesn’t allow reading/writing ACLs doesn’t mean you can’t read/write files in the bucket. Conversely, you may be able to list ACLs but not read/write to the bucket ## License MIT ## GitHub: > **[GitHub - sa7mon/S3Scanner: Scan for misconfigured S3 buckets across...](https://github.com/sa7mon/S3Scanner)** > > Scan for misconfigured S3 buckets across S3-compatible APIs!