Shulou(Shulou.com)05/31 Report--

How to take over AWS S3 bucket, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain for you in detail, people with this need can come to learn, I hope you can gain something.

What is AWS S3 bucket

Amazon S3 (Simple Storage Service) is a simple cloud storage.

All types of files can be stored in this service

But web developers usually use it to store static files.

Such as pictures, JavaScript files, and cascading stylesheet files.

Loophole principle

If the developer deletes the entire data and S3 bucket, but the bound CNAME record still needs to be deleted from the AWS console. In this case, the attacker can declare the S3 bucket using any other AWS account. This causes the attacker to exploit the S3 bucket account takeover vulnerability.

Loophole recurrence

We collect the corresponding assets through fofa

If the following page appears, you can take over.

The following page appears indicating that you cannot take over.

Log in to Aliyun and select COS

Create bucket

Fill in the obtained bucketname at the Bucket name, and then click OK

Now that we have completed the takeover, let's verify it through file management.

Access verification exists

Repair suggestion

Delete CNAME record

Is it helpful for you to read the above content? If you want to know more about the relevant knowledge or read more related articles, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.