Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/nuncan/slurp
The original slurp source
https://github.com/nuncan/slurp
amazon amazon-s3 aws bucket enum go s3 slurp vuln vulnerability
Last synced: about 1 month ago
JSON representation
The original slurp source
- Host: GitHub
- URL: https://github.com/nuncan/slurp
- Owner: nuncan
- License: agpl-3.0
- Created: 2018-09-10T05:44:39.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2018-11-25T03:06:07.000Z (about 6 years ago)
- Last Synced: 2024-08-01T08:10:35.331Z (4 months ago)
- Topics: amazon, amazon-s3, aws, bucket, enum, go, s3, slurp, vuln, vulnerability
- Language: Go
- Size: 12.9 MB
- Stars: 33
- Watchers: 3
- Forks: 9
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-bbht - slurp - Enumerate S3 buckets via certstream, domain, or keywords. (Content Discovery / AWS S3 Bucket)
- awesome-bbht - slurp - Enumerate S3 buckets via certstream, domain, or keywords. (Content Discovery / AWS S3 Bucket)
README
# slurp
Enumerate S3 buckets via certstream, domain, or keywords
## Overview
- First of all, credit to https://github.com/eth0izzle/bucket-stream for the certstream idea.
- Also, credit to all the vendor packages that made this tool possible.
- Not responsible for how you use this tool.
### Modes
#### Certstream
#### Domain
#### Keywords
### Features
- Written in Go:
- It's faster than python.
- No dependency hell and version locks (ie python 3 and requirements.txt, etc); easier to deploy, static binary, etc.
- Better concurrency.
- Punycode support for internationalized domains (S3 doesn't allow internationalized buckets; so this app just notifies and skips (certstream) or exits (domain mode)).
- Domain mode so that you can test individual domains.
- **New** Keywords mode so that you can attempt enumeration based on keywords. Why is this useful? Sometimes organizations have shorthand names that they go by. If you wanted to test that shorthand name you could not do so previously; now you can by using this mode of enumeration.
- **New** Supports a list of domains now.
- Certstream mode so that you can enumerate s3 buckets in real time.
- Colorized output for visual grep.
- Currently generates over 1200 permutations per domain and keyword.
- Strong copyleft license.
## Usage
- `slurp domain <-t|--target> google.com` will enumerate the S3 domains for a specific target.
- `slurp keyword <-t|--target> linux,golang,python` will enumerate S3 buckets based on those 3 key words.
- `slurp certstream` will follow certstream and enumerate S3 buckets from each domain.
- `permutations.json` stores the permutations that are used by the program; they are in JSON format and loaded during execution **this is required**; it assumes a specific format per permutation: `anything_you_want.%s`; the ending `.%s` is **required** otherwise the AWS S3 URL will not be attached to it, and therefore no results will come from S3 enumeration. If you need flexible permutations then see `PermutateDomain` function.
## Installation
- Download from Releases section, or build yourself with `go build` or `build.sh`.
- **Make sure you clone to `$GOPATH/src` or you will get build errors!**
## License
- AGPLv3