Bucky is an automatic tool designed to discover (https://www.kitploit.com/search/label/Discover) S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon (https://www.kitploit.com/search/label/Firefox%20Addon) and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular Expression(Regex) to match the S3 bucket used as Content Delivery Network(CDN) and sends it to the Bucky Backend engine. The backend engine receives the data from addon and checks if the S3 bucket is publicly writeable or not. Bucky automatically uploads a text file as Proof Of Concept(PoC) if the bucket is vulnerable.
Working
Bucky addon sends the details of s3 bucket name discovered from a user visited web pages to backend engine. It uses AWS PHP SDK (https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_installation.html) to discover misconfiguration. Users can also check for S3 bucket misconfiguration (https://www.kitploit.com/search/label/Misconfiguration) manually. All the results from automatic and manuall check are populated to dashboard. Checkout video https://vimeo.com/444442588
Installation
git clone https://github.com/smaranchand/bucky.git
cd bucky
Requirements: AWS Access (https://www.kitploit.com/search/label/Access) Keys and PHP installation Get AWS Access Keys: https://console.aws.amazon.com/iam/home?#/security_credentials PHP installation: Install according to your OS, apt install php7.3 / brew install php7.3 Currently, Bucky addon is not published in the Firefox (https://www.kitploit.com/search/label/Firefox) addon store; as soon as the addon will be published, the addon link will be provided. For now, users can manually load the addon into the browser to do so Open Firefox browser and visit about:debugging Click on "This Firefox" > Load Temporary Add-on Select the addon located at bucky/addon/bucky.js Add AWS Access keys: cd bucky/
nano config.inc.php
Add your AWS Access Key ID and Secret Access Key. (On-Line 57 and 61)
Usage
To use Bucky, load the Bucky addon to the browser and start backend engine. cd bucky/
chmod +x run.sh
./run.sh
The backend engine runs on http://127.0.0.1:13337
Browse websites, Bucky will discover S3 buckets automatically and will be reflected in the dashboard.
Visit the above address to access Bucky dashboard.
Screenshots
Running Bucky
___________________________
@hacking_Attack
@Hacking_Video
Working
Bucky addon sends the details of s3 bucket name discovered from a user visited web pages to backend engine. It uses AWS PHP SDK (https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_installation.html) to discover misconfiguration. Users can also check for S3 bucket misconfiguration (https://www.kitploit.com/search/label/Misconfiguration) manually. All the results from automatic and manuall check are populated to dashboard. Checkout video https://vimeo.com/444442588
Installation
git clone https://github.com/smaranchand/bucky.git
cd bucky
Requirements: AWS Access (https://www.kitploit.com/search/label/Access) Keys and PHP installation Get AWS Access Keys: https://console.aws.amazon.com/iam/home?#/security_credentials PHP installation: Install according to your OS, apt install php7.3 / brew install php7.3 Currently, Bucky addon is not published in the Firefox (https://www.kitploit.com/search/label/Firefox) addon store; as soon as the addon will be published, the addon link will be provided. For now, users can manually load the addon into the browser to do so Open Firefox browser and visit about:debugging Click on "This Firefox" > Load Temporary Add-on Select the addon located at bucky/addon/bucky.js Add AWS Access keys: cd bucky/
nano config.inc.php
Add your AWS Access Key ID and Secret Access Key. (On-Line 57 and 61)
Usage
To use Bucky, load the Bucky addon to the browser and start backend engine. cd bucky/
chmod +x run.sh
./run.sh
The backend engine runs on http://127.0.0.1:13337
Browse websites, Bucky will discover S3 buckets automatically and will be reflected in the dashboard.
Visit the above address to access Bucky dashboard.
Screenshots
Running Bucky
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Note
Bucky is not a perfect tool to discover S3 buckets, it is well known that Bucky lacks many feautres and it may fail to detect the misconfiguration sometimes. Certain changes and development are in pipeline. I really appreciate the feedbacks and contribution.
Download Bucky (https://github.com/smaranchand/bucky)
Bucky is not a perfect tool to discover S3 buckets, it is well known that Bucky lacks many feautres and it may fail to detect the misconfiguration sometimes. Certain changes and development are in pipeline. I really appreciate the feedbacks and contribution.
Download Bucky (https://github.com/smaranchand/bucky)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
TryHackMe | Inclusion Walkthrough
https://cdn-images-1.medium.com/max/600/1*DieS-NJomwwgf4YFFFshRg.png
This is a simple beginner-level Local file Inclusion box.
Continue reading on Medium »
TryHackMe | Inclusion Walkthrough
https://cdn-images-1.medium.com/max/600/1*DieS-NJomwwgf4YFFFshRg.png
This is a simple beginner-level Local file Inclusion box.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Campagne di spionaggio e hacking: Russia e USA
https://cdn-images-1.medium.com/max/2600/0*GzeCSolerdPrgx2y
Campagne di spionaggio e hacking: mentre Microsoft avvisa che il gruppo APT Nobelium — il collettivo hacker legato all’intelligence russa…
Continue reading on Medium »
Campagne di spionaggio e hacking: Russia e USA
https://cdn-images-1.medium.com/max/2600/0*GzeCSolerdPrgx2y
Campagne di spionaggio e hacking: mentre Microsoft avvisa che il gruppo APT Nobelium — il collettivo hacker legato all’intelligence russa…
Continue reading on Medium »