From 40067cc307284753e48edab8fc60f4d5bb40b01c Mon Sep 17 00:00:00 2001 From: Cory Solovewicz Date: Sun, 3 Oct 2021 23:54:44 -0700 Subject: [PATCH 1/3] Refactored code to Python 3. Updated README to include requirements and to additional information on how to install using Python Virtual Environment. Added requirements.txt and added env/ to .gitignore. --- .gitignore | 6 ++++++ README.md | 24 ++++++++++++++++-------- requirements.txt | 1 + sandcastle.py | 15 +++++++-------- 4 files changed, 30 insertions(+), 16 deletions(-) create mode 100644 requirements.txt diff --git a/.gitignore b/.gitignore index 1d8dd28..e6172d4 100644 --- a/.gitignore +++ b/.gitignore @@ -2,9 +2,15 @@ __pycache__/ *.py[cod] +# python virtualenv +env/ + # C extensions *.so +# macOS +.DS_Store + # Distribution / packaging bin/ build/ diff --git a/README.md b/README.md index 97acc41..b0ab913 100644 --- a/README.md +++ b/README.md @@ -16,12 +16,20 @@ The script takes a target's name as the stem argument (e.g. `shopify`) and itera [...] ``` +## Requirements +* Python 3 +* Python requests module + ## Getting started Here's how to get started: -1. Clone this repo (PyPi distribution temporarily disabled). -2. Run `sandcastle.py` with a target name and input file (grab an example from this repo) -3. Matching bucket permutations will be identified, and read permissions tested. +1. Clone this repo. +2. Install python virtual environment `python3 -m pip install --user virtualenv` +3. Create and activate virtual environment `python3 -m venv env && source env/bin/activate` +4. Install requirements `pip install -r requirements.txt` +5. Run `sandcastle.py` with a target name and input file (grab an example from this repo) +6. Matching bucket permutations will be identified, and read permissions tested. +* When you're finished running the project you can exit the virtual environment with the command `deactivate` ``` usage: sandcastle.py [-h] -t targetStem [-f inputFile] @@ -54,11 +62,11 @@ An error occurred (AccessDenied) when calling the ListObjects operation: Access ### Status codes and testing -| Status code | Definition | Notes | -| ------------- | ------------- | -----| -| 404 | Bucket Not Found | Not a target for analysis (hidden by default)| -| 403 | Access Denied | Potential target for analysis via the CLI | -| 200 | Publicly Accessible | Potential target for analysis via the CLI | +| Status code | Definition | Notes| +| ------------- | ------------- | -----| +| 404 | Bucket Not Found | Not a target for analysis (hidden by default)| +| 403 | Access Denied | Potential target for analysis via the CLI | +| 200 | Publicly Accessible | Potential target for analysis via the CLI | ### AWS CLI commands Here's a quick reference of some useful AWS CLI commands: diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..663bd1f --- /dev/null +++ b/requirements.txt @@ -0,0 +1 @@ +requests \ No newline at end of file diff --git a/sandcastle.py b/sandcastle.py index 7737b64..a5b2f8a 100755 --- a/sandcastle.py +++ b/sandcastle.py @@ -1,10 +1,10 @@ #!/usr/bin/env python # -*- coding: utf-8 -*- -import sys, os, commands, requests +import sys, os, subprocess, requests from argparse import ArgumentParser -print """ +print (""" ____ __ __ __ / __/__ ____ ___/ /______ ____ / /_/ /__ _\ \/ _ `/ _ \/ _ / __/ _ `(_- %s" % (args.targetStem, name, r.status_code) - check = commands.getoutput("/usr/local/bin/aws s3 ls s3://%s%s" % (args.targetStem, name)) - print check + print ("[+] Checking potential match: %s%s --> %s" % (args.targetStem, name, r.status_code)) + check = subprocess.run(['/usr/local/bin/aws', 's3', 'ls', '--recursive', '--human-readable', '--summarize','s3://%s%s' % (args.targetStem, name)], stderr=subprocess.STDOUT) else: sys.stdout.write('') -print "[*] Enumeration of '%s' buckets complete." % (args.targetStem) +print ("[*] Enumeration of '%s' buckets complete." % (args.targetStem)) # macOS, coming soon: os.system("notify Enumeration of %s buckets complete." % (args.targetStem)) From 02775f8ad73dc41818db8b1ceee0a5ba87ad0fef Mon Sep 17 00:00:00 2001 From: Cory Solovewicz Date: Mon, 4 Oct 2021 00:20:21 -0700 Subject: [PATCH 2/3] Update README.md Added AWS CLI Version 2 as a requirement. --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b0ab913..74d9ad3 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,7 @@ The script takes a target's name as the stem argument (e.g. `shopify`) and itera ## Requirements * Python 3 * Python requests module +* [AWS CLI Version 2](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) ## Getting started Here's how to get started: @@ -26,7 +27,7 @@ Here's how to get started: 1. Clone this repo. 2. Install python virtual environment `python3 -m pip install --user virtualenv` 3. Create and activate virtual environment `python3 -m venv env && source env/bin/activate` -4. Install requirements `pip install -r requirements.txt` +4. Install python module(s) `pip install -r requirements.txt` 5. Run `sandcastle.py` with a target name and input file (grab an example from this repo) 6. Matching bucket permutations will be identified, and read permissions tested. * When you're finished running the project you can exit the virtual environment with the command `deactivate` From 2a70e0480103700d6d4fa0274455e7d9f2dde36d Mon Sep 17 00:00:00 2001 From: CorySolovewicz Date: Mon, 4 Oct 2021 00:40:56 -0700 Subject: [PATCH 3/3] Adding additional information on the need for AWS signing keys to make requests via the aws commandline tool --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 74d9ad3..daa9b08 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,10 @@ The script takes a target's name as the stem argument (e.g. `shopify`) and itera * Python 3 * Python requests module * [AWS CLI Version 2](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) +* [AWS Account](https://portal.aws.amazon.com/billing/signup#/account) +* [AWS Access Key ID and Secret Access Key](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) + + ## Getting started Here's how to get started: