redhuntlabs/bucketlootBucketLoot is an automated S3-compatible bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text.
An Automated S3-compatible Bucket Inspector
Description • Installation • Features • Documentation • Acknowledgements
You can install BucketLoot using either of these methods:
go install github.com/redhuntlabs/bucketloot/cmd/bucketloot@latest
# Clone the repository
git clone https://github.com/redhuntlabs/BucketLoot.git
cd BucketLoot
# Install the tool
go install ./cmd/bucketloot
After installation, you can run bucketloot from anywhere in your terminal!
# Basic usage
bucketloot https://example-bucket.s3.amazonaws.com
# With options
bucketloot -slow -notify https://example-bucket.s3.amazonaws.com
# Search for keywords
bucketloot -search "password" https://example-bucket.s3.amazonaws.com
# Save output
bucketloot -save results.json https://example-bucket.s3.amazonaws.com
# Full scan mode (requires credentials.json)
bucketloot -full https://example-bucket.s3.amazonaws.com
For notifications and full scan mode, you'll need to create notifyConfig.json and credentials.json in your working directory. See the documentation for more details.