Festin logo

`FestIN` the powered S3 bucket finder and content discover

What is FestIn
Why Festin
Install
- Using Python
- Using Docker
Full options
Usage
Example: Mixing FesIn + DnsRecon
F.A.Q.
Who uses FestIn
MrLooquer
License

What is FestIn

FestIn is a tool for discovering open S3 Buckets starting from a domains.

It perform a lot of test and collects information from:

DNS
Web Pages (Crawler)
S3 bucket itself (like S3 redirections)

Why Festin

There's a lot of S3 tools for enumeration and discover S3 bucket. Some of them are great but anyone have a complete list of features that Festin has.

Main features that does Festin great:

Various techniques for finding buckets: crawling, dns crawling and S3 responses analysis.
Proxy support for tunneling requests.
AWS credentials are not needed.
Works with any S3 compatible provider, not only with AWS.
Allows to configure custom DNS servers.
Integrated high performance HTTP crawler.
Recursively search and feedback from the 3 engines: a domain found by dns crawler is send to S3 and Http Crawlers analyzer and the same for the S3 and Crawler.
Works as 'watching' mode, listening for new domains in real time.
Save all of the domains discovered in a separate file for further analysis.
Allow to download bucket objects and put then in a FullText Search Engine (Redis Search) automatically, indexing the objects content allowing powerful search further.
Limit the search for specific domain/s.

Install

Using Python

Python 3.8 of above needed!

$ pip install festin
$ festin -h

Using Docker

$ docker run --rm -it cr0hn/festin -h

Full options

$ festin -h
usage: __main__.py [-h] [--version] [-f FILE_DOMAINS] [-w] [-c CONCURRENCY] [--no-links] [-T HTTP_TIMEOUT] [-M HTTP_MAX_RECURSION] [-dr DOMAIN_REGEX] [-rr RESULT_FILE] [-rd DISCOVERED_DOMAINS] [-ra RAW_DISCOVERED_DOMAINS]
                   [--tor] [--debug] [--no-print] [-q] [--index] [--index-server INDEX_SERVER] [-dn] [-ds DNS_RESOLVER]
                   [domains [domains ...]]

Festin - the powered S3 bucket finder and content discover

positional arguments:
  domains

optional arguments:
  -h, --help            show this help message and exit
  --version             show version
  -f FILE_DOMAINS, --file-domains FILE_DOMAINS
                        file with domains
  -w, --watch           watch for new domains in file domains '-f' option
  -c CONCURRENCY, --concurrency CONCURRENCY
                        max concurrency

HTTP Probes:
  --no-links            extract web site links
  -T HTTP_TIMEOUT, --http-timeout HTTP_TIMEOUT
                        set timeout for http connections
  -M HTTP_MAX_RECURSION, --http-max-recursion HTTP_MAX_RECURSION
                        maximum recursison when follow links
  -dr DOMAIN_REGEX, --domain-regex DOMAIN_REGEX
                        only follow domains that matches this regex

Results:
  -rr RESULT_FILE, --result-file RESULT_FILE
                        results file
  -rd DISCOVERED_DOMAINS, --discovered-domains DISCOVERED_DOMAINS
                        file name for storing new discovered after apply filters
  -ra RAW_DISCOVERED_DOMAINS, --raw-discovered-domains RAW_DISCOVERED_DOMAINS
                        file name for storing any domain without filters

Connectivity:
  --tor                 Use Tor as proxy

Display options:
  --debug               enable debug mode
  --no-print            doesn't print results in screen
  -q, --quiet           Use quiet mode

Redis Search:
  --index               Download and index documents into Redis
  --index-server INDEX_SERVER
                        Redis Search ServerDefault: redis://localhost:6379

DNS options:
  -dn, --no-dnsdiscover
                        not follow dns cnames
  -ds DNS_RESOLVER, --dns-resolver DNS_RESOLVER
                        comma separated custom domain name servers

Usage

Configure search domains

By default FestIn accepts a start domain as command line parameter:

> festin mydomain.com

But you also cat setup an external file with a list of domains:

> cat domains.txt
domain1.com
domain2.com
domain3.com
> festin -f domains.txt

Concurrency

FestIn performs a lot of test for a domain. Each test was made concurrently. By default concurrency is set to 5. If you want to increase the number of concurrency tests you must set the option -c

> festin -c 10 mydomain.com

Be carefull with the number of concurrency test or "alarms" could raises in some web sites.

HTTP Crawling configuration

FestIn embed a small crawler to discover links to S3 buckets. Crawler accepts these options:

Timeout (-T or --http-timeout): configure a timeout for HTTP connections. If website of the domain you want to analyze is slow, we recommend to increase this value. By default timeout is 5 seconds.
Maximum recursion (-H or --http-max-recursion): this value setup a limit for crawling recursion. Otherwise FestIn will scan all internet. By default this value is 3. It means that only will follow: domain1.com -> [link] -> domain2.com -> [link] -> domain3.com -> [link] -> Maximum recursion reached. Stop
Limit domains (-dr or --domain-regex): set this option to limit crawler to these domains that matches with this regex.
Black list (-B): configure a black list words file. Each domain that matches with some word in the black list will be skipped.
White list (-W): configure a white list words file. Each domain that DOESN'T match with some word in the white list will be skipped.

Example:

> echo "cdn" > blacklist.txt
> echo "photos" >> blacklist.txt
> festin -T 20 -M 8 -B blacklist.txt -dr .mydomain. mydomain.com

BE CAREFUL: -dr (or --domain-regex) only accept valid POSIX regex. 

*mydomain.com* -> is not a valida POSIX regex
.mydomain\.com. -> is a valida POSIX regex

Manage results

When FestIn runs it discover a lot of useful information. Not only about S3 buckets, also for other probes we could do. For example:

festin

Most Popular

FestIN the powered S3 bucket finder and content discover