Skip to content

Instantly share code, notes, and snippets.

View stringpilot's full-sized avatar

Voxl stringpilot

1 follower · 5 following
View GitHub Profile
@stringpilot
stringpilot / bucket-disclose.sh
Created October 17, 2021 05:30 — forked from jhaddix/bucket-disclose.sh
Using error messages to decloak an S3 bucket. Uses soap, unicode, post, multipart, streaming and index listing as ways of figure it out. You do need a valid aws-key (never the secret) to properly get the error messages
#!/bin/bash
# Written by Frans Rosén (twitter.com/fransrosen)
_debug="$2" #turn on debug
_timeout="20"
#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
_aws_key="AKIA..."
H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"
@stringpilot
stringpilot / WAHH_Task_Checklist.md
Created October 17, 2021 05:38 — forked from jhaddix/Testing_Checklist.md
The Web Application Hacker's Handbook - Task Checklist - Github-Flavored Markdown
@stringpilot
stringpilot / Github bash generated search links (from hunter.sh)
Created October 17, 2021 05:58 — forked from jhaddix/Github bash generated search links (from hunter.sh)
Github bash generated search links (from hunter.sh)