S3 Bucket Brute Force to Breach

This beginner-friendly lab teaches how predictable S3 bucket naming conventions can expose sensitive data and enable a full cloud attack chain. Starting from one known bucket, you brute force additional buckets, recover leaked AWS keys, retrieve a secret from SSM Parameter Store, and finally invoke a Lambda function that returns crew PII.

Huge Logistics has hired you to evaluate their cloud security after a preliminary scan revealed an S3 bucket named hlogistics-web. Your mission is to use the naming convention to find other buckets and pivot to further cloud services.

• Basic Linux command line knowledge
• AWS CLI installed
• Provided starting S3 bucket name

• Confirm bucket existence and region using a curl request
• Brute force S3 bucket names across regions with the ffuf fuzzer and wordlists
• Enumerate and download bucket contents anonymously using the AWS CLI no-sign-request flag
• Recover hardcoded AWS keys from a leaked Python file
• Enumerate IAM user policies and read the SSM parameter secret with GetParameter
• Enumerate permissions with aws-enumerator and pivot between IAM users
• List and invoke a Lambda function to exfiltrate crew PII

S3 bucket names are globally unique and often predictably named to company standards, so misconfigured buckets have repeatedly led to large data exposures and have driven a whole class of bucket discovery automation.