S3cret Scanner: Hunting For Secrets Uploaded To Public S3 Buckets

S3cret Scanner: Hunting For Secrets Uploaded To Public S3 Buckets

Automation workflow

The automation will perform the following actions:

  1. List the public buckets in the account (Set with ACL of Public or objects can be public)
  2. List the textual or sensitive files (i.e. .p12, .pgp and more)
  3. Download, scan (using truffleHog3), and delete the files from the disk, once done evaluating, one by one.
  4. The logs will be created in the logger.log file.

Installation

Prerequisites

  1. Python 3.6 or above
  2. TruffleHog3 installed in $PATH
  3. An AWS role with the following permissions:
    {
    
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "VisualEditor0",
    "Effect": "Allow",
    "Action": [
    "s3:GetLifecycleConfiguration",
    "s3:GetBucketTagging",
    "s3:ListBucket",
    "s3:GetAccelerateConfiguration",
    "s3:GetBucketPolicy",
    "s3:GetBucketPublicAccessBlock",
    "s3:GetBucketPolicyStatus",
    "s3:GetBucketAcl",
    "s3:GetBucketLocation"
    ],
    "Resource": "arn:aws:s3:::*"
    },
    ]
    }
  4. If you’re using a CSV file – make sure to place the file accounts.csv in the csv directory, in the following format:
    Account name,Account id
    
    prod,123456789
    ci,321654987
    dev,148739578

Install

git clone https://github.com/Eilonh/s3crets_scanner.git

pip3 install -r requirements.txt

pip3 install trufflehog3

Use

Copyright (C) 2022 Eilonh 

Source: https://github.com/Eilonh/