From b282bc5030364bd2ebc3bc6e1b2c0af9d304f253 Mon Sep 17 00:00:00 2001 From: homedirectory <47361170+homedirectory@users.noreply.github.com> Date: Wed, 29 Sep 2021 10:19:54 +0300 Subject: [PATCH] Update aws-s3.md --- pentesting/pentesting-web/buckets/aws-s3.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pentesting/pentesting-web/buckets/aws-s3.md b/pentesting/pentesting-web/buckets/aws-s3.md index 0e99eb14..94a6116d 100644 --- a/pentesting/pentesting-web/buckets/aws-s3.md +++ b/pentesting/pentesting-web/buckets/aws-s3.md @@ -6,7 +6,7 @@ A bucket is typically considered “public” if any user can list the contents It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket. And although a file might be listed in a bucket it does not necessarily mean that it can be downloaded. Buckets and objects have their own access control lists \(ACLs\). Amazon provides information on managing access controls for buckets [here](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAuthAccess.html). Furthermore, Amazon helps their users by publishing a best practices document on [public access considerations around S3 buckets](http://aws.amazon.com/articles/5050). The default configuration of an S3 bucket is private. -**Learn about AWS-S3 misconfiguration here:** [ **http://flaws.cloud**](%20http://flaws.cloud) **and** [**http://flaws2.cloud/**](http://flaws2.cloud/) **\(Most of the information here has been take from those resources\)** +**Learn about AWS-S3 misconfiguration here:** [ **http://flaws.cloud**](%20http://flaws.cloud) **and** [**http://flaws2.cloud/**](http://flaws2.cloud/) **\(Most of the information here has been taken from those resources\)** #### **Regions** @@ -71,7 +71,7 @@ Check that the resolved domain have the word "website". You can access the static website going to: `flaws.cloud.s3-website-us-west-2.amazonaws.com` or you can access the bucket visiting: `flaws.cloud.s3-us-west-2.amazonaws.com` -If you tries to access a bucket but in the domain name you specifies another region \(for example the bucket is in `bucket.s3.amazonaws.com` but you try to access `bucket.s3-website-us-west-2.amazonaws.com` you will be redirected to the correct location. +If you try to access a bucket, but in the domain name you specify another region \(for example the bucket is in `bucket.s3.amazonaws.com` but you try to access `bucket.s3-website-us-west-2.amazonaws.com`, then you will be redirected to the correct location. ## Enumerating the bucket