BlobHunter: Find exposed data in Azure

BlobHunter

An opensource tool for scanning Azure blob storage accounts for publicly opened blobs.
BlobHunter is a part of “Hunting Azure Blobs Exposes Millions of Sensitive Files” research.

Overview

BlobHunter helps you identify Azure blob storage containers which store files that are publicly available to anyone with an internet connection.
The tool will help mitigate risk by identifying poorly configured containers that store sensitive data, which is specifically helpful in larger-scale Azure subscriptions where there are a significant number of storage accounts that could be hard to track.
BlobHunter produces an informative csv result file that provides important details on each publicly opened container in the scanned environment.

Install

Requirements

1. Python 3.5+
2. Azure CLI
3. requirements.txt packages
4. Azure user with one of the following built-in roles:
   • Owner
   • Contributor
   • Storage Account Contributor

   Or any Azure user with a role that allows to perform the following Azure actions:

   Microsoft.Resources/subscriptions/read
   Microsoft.Resources/subscriptions/resourceGroups/read
   Microsoft.Storage/storageAccounts/read
   Microsoft.Storage/storageAccounts/listkeys/action
   Microsoft.Storage/storageAccounts/blobServices/containers/read
   Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Build

git clone https://github.com/cyberark/BlobHunter.git

Use

python3 BlobHunter.py

If you are not logged in in the Azure CLI, a browser window will be prompted at you for inserting your Azure user credentials.

Copyright (c) 2021 CyberArk Software Ltd.

Source: https://github.com/cyberark/