ooafa/bucketbusterScans public cloud object-storage endpoints across Yandex, VK, Selectel, Sber, Alibaba, Tencent, Huawei, and Baidu to find listable buckets and exposed objects.
Cloud object-storage exposure scanner and read-only storage CLI for authorized security testing, bug bounty work, and infrastructure you own.
BucketBuster checks candidate bucket names against public endpoints for Yandex Cloud, VK Cloud, Selectel, SberCloud, Alibaba OSS, Tencent COS, Huawei OBS, Baidu BOS, and China Mobile Cloud EOS. It can identify publicly listable buckets, match certificate-related object names, and optionally download publicly accessible objects over HTTP GET. Storage commands also support authenticated listings, downloads, metadata, and signed URLs using each provider's native credentials.
Authorization required: Use this tool only against assets you own or have explicit permission to test. Scanning or downloading data from third-party buckets may be illegal. You are responsible for complying with applicable laws, contracts, bug-bounty rules, and provider policies.
scan only.git clone <repository-url>
cd bucketbuster
python -m venv .venv
Activate the virtual environment:
# Linux/macOS
source .venv/bin/activate
# Windows PowerShell
.\.venv\Scripts\Activate.ps1
Install dependencies:
python -m pip install -r requirements.txt
Create a wordlist such as buckets.txt:
example-company
example-company-backup
example-company-documents
Run the default provider set, Yandex Cloud and VK Cloud:
python bucketbuster.py scan --wordlist buckets.txt
The scanner reports HTTP 200 responses, public listings, matching object names, and access-denied endpoints that appear to exist. A 404 response is ignored.
CLI change: A command is now required. Existing invocations beginning with
python bucketbuster.py -w ... must become python bucketbuster.py scan -w ....
| Provider flag | Service | Included endpoint families |
|---|---|---|
yandex | Yandex Cloud | Storage and website endpoints |
vk | VK Cloud | vkcloud-storage.ru endpoints |
selectel | Selectel | S3 and selstorage.ru endpoints |
sber | SberCloud | OBS and s3.cloud.ru endpoints |
aliyun | Alibaba Cloud OSS | Selected China regions |
tencent | Tencent Cloud COS | Selected China and Asia regions |
huawei | Huawei Cloud OBS | Selected China regions |
baidu | Baidu Cloud BOS | Selected China and Asia regions |
cmecloud | China Mobile Cloud EOS | 30 regions from the supplied EOS tool |
Provider groups:
--providers russia # yandex, vk, selectel, sber
--providers china # aliyun, tencent, huawei, baidu, cmecloud
--providers all # every supported provider
You can also provide a comma-separated list, for example:
python bucketbuster.py scan -w buckets.txt --providers aliyun,tencent
Each provider uses its own credentials. Keys for one provider are never reused
for another, and unrelated AWS profiles, instance metadata, or .netrc entries
are not used to authenticate requests.
| Provider | Authenticated API |
|---|---|
yandex, vk, selectel, cmecloud | S3 Signature V4 through boto3 |
aliyun | Native OSS V4 through oss2 |
tencent | Native COS through cos-python-sdk-v5 |
huawei | Native OBS through esdk-obs-python |
sber | OBS for obs.*.hc.sbercloud.ru; S3 for s3.cloud.ru |
baidu | Native BCE/BOS signing for regional BOS; S3 for s3.*.bcebos.com |
Set environment variables using the provider flag in uppercase:
BUCKETBUSTER_<PROVIDER>_ACCESS_KEY_ID
BUCKETBUSTER_<PROVIDER>_ACCESS_KEY_SECRET
BUCKETBUSTER_<PROVIDER>_SESSION_TOKEN
BUCKETBUSTER_<PROVIDER>_ENDPOINT
BUCKETBUSTER_<PROVIDER>_REGION
For example, BUCKETBUSTER_CMECLOUD_ACCESS_KEY_ID and
BUCKETBUSTER_CMECLOUD_ACCESS_KEY_SECRET. CMECloud also accepts the standalone
tool's EOS_ACCESS_KEY_ID, EOS_ACCESS_KEY_SECRET, EOS_SESSION_TOKEN,
EOS_ENDPOINT, and EOS_REGION variables as lower-priority aliases.
For storage commands, explicit --access-key-id, --access-key-secret, and
optional --session-token override environment values per field. For scanning,
use provider-specific flags such as --cmecloud-access-key-id and
--cmecloud-access-key-secret; the same pattern works for every provider.
An incomplete key pair, or a token without a pair, is rejected.
Prefer environment variables: command-line secrets may appear in shell history and process listings. Do not include actual credentials in reports or bug submissions.
Commands select exactly one --provider; they do not need a wordlist or probe
all regions. Common options may appear before or after the command, like the
supplied EOS tool:
python bucketbuster.py --provider cmecloud \
--endpoint eos-beijing-1.cmecloud.cn --region beijing-1 list-buckets
python bucketbuster.py list-objects --provider cmecloud \
--endpoint eos.ecso.hecd-1.cmecloud.cn --bucket example-company --key certificates/
python bucketbuster.py list-objects --provider cmecloud \
--bucket example-company --key certificates/ --max-keys 100
python bucketbuster.py list-objects-all --provider cmecloud \
--bucket example-company --prefix documents/
python bucketbuster.py download-bucket --provider cmecloud \
--bucket example-company --prefix documents/ --output-dir ./authorized-downloads
python bucketbuster.py get-object --provider cmecloud \
--bucket example-company --key documents/readme.txt --output ./readme.txt
python bucketbuster.py head-object --provider cmecloud \
--bucket example-company --key documents/readme.txt
python bucketbuster.py presign --provider cmecloud \
--bucket example-company --key documents/readme.txt --expires 600
| Command | Behavior and options |
|---|---|
list-buckets | List account buckets; requires a credential pair and account-list permission. With no --region or --endpoint, every known region for the provider is tried and results are de-duplicated. |
list-objects | One listing page; --key is a prefix, with --marker, --max-keys, and --delimiter. |
list-objects-all | Automatically paginate; --prefix, --delimiter, and --max-keys. |
download-bucket | Download every prefix-matching object over all pages; --prefix, --max-keys, --output-dir/-o (default: bucket name). |
get-object | Download --key; --output/-o or a safe key-relative path under the current directory. --stream writes object bytes only to stdout. |
head-object | Return metadata for --key. |
presign | Print a signed GET URL; requires credentials. --expires defaults to 3600 seconds, range 1-604800. |
Except for list-buckets, all storage commands require --bucket. Reads can
be anonymous where the bucket permits them; supplied credentials enable access
only where their permissions allow it. Normal results are JSON; presign
prints the URL and get-object --stream emits bytes. Errors go to stderr and
return a nonzero exit code. A signed URL is a bearer credential: protect it.