Refactored code to Python 3 and Updated install instructions to use Python Virtual Environment

.gitignore

@@ -2,9 +2,15 @@
 __pycache__/
 *.py[cod]
 
+# python virtualenv
+env/
+
 # C extensions
 *.so
 
+# macOS
+.DS_Store
+
 # Distribution / packaging
 bin/
 build/

README.md

@@ -16,12 +16,25 @@ The script takes a target's name as the stem argument (e.g. `shopify`) and itera
 [...]
 ```
 
+## Requirements
+* Python 3
+* Python requests module
+* [AWS CLI Version 2](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html)
+* [AWS Account](https://portal.aws.amazon.com/billing/signup#/account)
+* [AWS Access Key ID and Secret Access Key](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html)
+
+
+
 ## Getting started
 Here's how to get started:
 
-1. Clone this repo (PyPi distribution temporarily disabled).
-2. Run `sandcastle.py` with a target name and input file (grab an example from this repo)
-3. Matching bucket permutations will be identified, and read permissions tested.
+1. Clone this repo.
+2. Install python virtual environment `python3 -m pip install --user virtualenv`
+3. Create and activate virtual environment `python3 -m venv env && source env/bin/activate` 
+4. Install python module(s) `pip install -r requirements.txt`
+5. Run `sandcastle.py` with a target name and input file (grab an example from this repo)
+6. Matching bucket permutations will be identified, and read permissions tested.
+* When you're finished running the project you can exit the virtual environment with the command `deactivate`
 
 ```
 usage: sandcastle.py [-h] -t targetStem [-f inputFile]
@@ -54,11 +67,11 @@ An error occurred (AccessDenied) when calling the ListObjects operation: Access
 
 ### Status codes and testing
 
-| Status code        | Definition           | Notes  |
-| ------------- | ------------- | -----|
-| 404      | Bucket Not Found | Not a target for analysis (hidden by default)|
-| 403      | Access Denied      |   Potential target for analysis via the CLI |
-| 200 | Publicly Accessible      |    Potential target for analysis via the CLI  |
+| Status code        | Definition     | Notes|
+| ------------- | -------------       | -----|
+| 404           | Bucket Not Found    | Not a target for analysis (hidden by default)|
+| 403           | Access Denied       | Potential target for analysis via the CLI |
+| 200           | Publicly Accessible | Potential target for analysis via the CLI |
 
 ### AWS CLI commands
 Here's a quick reference of some useful AWS CLI commands:

requirements.txt

@@ -0,0 +1 @@
+requests

sandcastle.py

@@ -1,18 +1,18 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 
-import sys, os, commands, requests
+import sys, os, subprocess, requests
 from argparse import ArgumentParser
 
-print """
+print ("""
    ____             __             __  __   
   / __/__ ____  ___/ /______ ____ / /_/ /__ 
  _\ \/ _ `/ _ \/ _  / __/ _ `(_-</ __/ / -_)
 /___/\_,_/_//_/\_,_/\__/\_,_/___/\__/_/\__/ 
 
 S3 bucket enumeration // release v1.2.4 // ysx
 
-"""
+""")
 targetStem = ""
 inputFile = ""
 
@@ -27,17 +27,16 @@
     bucketNames = [line.strip() for line in f] 
     lineCount = len(bucketNames)
 
-print "[*] Commencing enumeration of '%s', reading %i lines from '%s'." % (args.targetStem, lineCount, f.name)
+print ("[*] Commencing enumeration of '%s', reading %i lines from '%s'." % (args.targetStem, lineCount, f.name))
 
 for name in bucketNames:
 	r = requests.head("http://%s%s.s3.amazonaws.com" % (args.targetStem, name))
 	if r.status_code != 404:
                 # macOS, coming soon: os.system("notify Potential match found! %s%s: %s" % (args.targetStem, name, r.status_code))
-		print "[+] Checking potential match: %s%s --> %s" % (args.targetStem, name, r.status_code)
-		check = commands.getoutput("/usr/local/bin/aws s3 ls s3://%s%s" % (args.targetStem, name))
-		print check
+		print ("[+] Checking potential match: %s%s --> %s" % (args.targetStem, name, r.status_code))
+		check = subprocess.run(['/usr/local/bin/aws', 's3', 'ls', '--recursive', '--human-readable', '--summarize','s3://%s%s' % (args.targetStem, name)], stderr=subprocess.STDOUT)
 	else:
 		sys.stdout.write('')
 
-print "[*] Enumeration of '%s' buckets complete." % (args.targetStem)
+print ("[*] Enumeration of '%s' buckets complete." % (args.targetStem))
 # macOS, coming soon: os.system("notify Enumeration of %s buckets complete." % (args.targetStem))