Stop Missing Exposed S3 Buckets! Use S3Scanner Instead

Stop Missing Exposed S3 Buckets! Use S3Scanner Instead

Your cloud storage is bleeding data—and you don't even know it.

Every day, terabytes of sensitive information sit exposed in misconfigured S3 buckets across AWS^{↗ Bright Coding Blog}, Google Cloud, DigitalOcean, and dozens of other providers. Customer databases. Financial records. Source code. Medical files. All of it—publicly accessible because someone forgot to flip a permission switch, or because a DevOps^{↗ Bright Coding Blog} script went rogue, or because "temporary" access became permanent.

Here's the gut-punch: the average data breach caused by misconfigured cloud storage costs $4.45 million. And the worst part? These breaches are entirely preventable. The tools to find them exist. The problem is that most security teams are still running manual checks, cobbling together scripts, or simply hoping their cloud provider's default settings are "good enough."

They're not.

Enter S3Scanner—the open-source, multi-threaded, multi-cloud bucket scanner that's quietly becoming the secret weapon of bug bounty hunters, red teamers, and cloud security engineers worldwide. Built by sa7mon and battle-tested by tools like reconftw, reNgine, and Axiom, S3Scanner doesn't just find buckets. It exposes the exact misconfigurations that let attackers read, write, or even take full control of your object storage.

If you're still relying on cloud provider dashboards or basic CLI commands to audit bucket permissions, you're flying blind. This article will show you exactly why S3Scanner is the upgrade your security workflow demands—and how to deploy it in minutes.

What is S3Scanner?

S3Scanner is a high-performance, Go-based command-line tool designed to scan S3-compatible object storage services for permission misconfigurations. Created by security researcher sa7mon and released under the MIT license, it has evolved from a simple AWS bucket scanner into a multi-cloud reconnaissance platform trusted by some of the most popular offensive security frameworks in the industry.

The project's core mission is deceptively simple: find open S3 buckets before attackers do. But its execution is what makes it indispensable. Unlike basic tools that only check if a bucket exists, S3Scanner performs deep permission analysis—testing for Read, Write, Read ACP, Write ACP, and Full Control access across both authenticated and anonymous user contexts.

Why it's trending now:

Cloud misconfigurations have exploded into the #1 cause of data breaches according to multiple industry reports. As organizations rush to adopt multi-cloud strategies—spreading data across AWS, GCP, DigitalOcean Spaces, Linode Object Storage, and others—the attack surface fragments. Security teams need unified tools that speak multiple cloud "dialects." S3Scanner answers this need with built-in support for seven major providers plus custom endpoint configurations for internal or emerging services.

The tool's adoption by heavyweight projects signals its maturity:

• reconftw — A comprehensive reconnaissance framework by six2dez
• reNgine — An automated reconnaissance pipeline by yogeshojha
• Axiom — The dynamic infrastructure framework by pry0cc

These aren't toys. They're production tools used by professional penetration testers and security researchers. When they integrate S3Scanner, they're betting their workflows on its reliability and depth.

Sponsorship from Tines, a security automation platform, further validates its enterprise relevance. This isn't weekend project ware—it's infrastructure-grade open source.

Key Features That Make S3Scanner Irreplaceable

⚡️ Multi-Threaded Scanning at Scale

S3Scanner leverages Go's goroutine model to scan multiple buckets simultaneously. The default -threads 4 setting balances speed with rate-limit politeness, but you can crank this higher for internal assessments. Critical insight: thread scaling applies to bucket enumeration, not per-bucket object listing—object enumeration remains single-threaded to avoid overwhelming target APIs.

🔭 Universal Cloud Provider Support

Stop juggling provider-specific tools. S3Scanner ships with pre-configured support for:

The custom provider system is particularly powerful. Define your own endpoint_format, address_style (path or vhost), regions, and SSL behavior via YAML configuration. This means S3Scanner adapts to your infrastructure, not the other way around.

🕵️‍♀️ Deep Permission Reconnaissance

This is where S3Scanner separates from toy scripts. It systematically probes for:

• Read — Can anonymous users list and download objects?
• Write — Can anyone upload files (potential for malware distribution or defacement)?
• Read ACP — Can access control policies be exfiltrated?
• Write ACP — Can permissions be modified to grant further access?
• Full Control — The nuclear option: complete anonymous ownership

The nuance matters. As the documentation emphasizes, ACL readability doesn't imply file accessibility—and vice versa. S3Scanner's granular reporting lets you interpret the actual risk, not just binary "open/closed" status.

💾 PostgreSQL^{↗ Bright Coding Blog} Integration for Enterprise Workflows

Raw console output doesn't scale. S3Scanner's -db flag streams results directly to PostgreSQL via GORM, with automatic schema migration. Build dashboards. Correlate findings across scans. Generate compliance reports. The database becomes your single source of cloud storage truth.

🐇 RabbitMQ for Automated Pipeline Integration

For continuous security monitoring, S3Scanner consumes bucket names from RabbitMQ queues. This enables:

• Event-driven scanning when new buckets are provisioned
• Integration with CI/CD pipelines
• Distributed scanning across multiple workers
• Real-time alerting workflows

The mqingest example in the repository shows exactly how to publish Bucket objects from your own Go applications.

🐳 Docker^{↗ Bright Coding Blog}-First Deployment

Every platform. Zero dependency hell. The official container (ghcr.io/sa7mon/s3scanner) ensures consistent execution whether you're on a Kali pentest laptop, a CI runner, or a production Kubernetes cluster.

Real-World Use Cases Where S3Scanner Shines

Bug Bounty Hunting: Finding Your Next Critical

Public bucket exposure routinely pays $5,000–$50,000+ on major platforms. S3Scanner's -bucket-file mode lets you seed it with generated or discovered bucket names, while -enumerate maps the full object tree. Combine with jq parsing to programmatically identify buckets containing sensitive filenames—backup.sql, credentials.json, customer_data.csv.

Red Team Assessments: Mapping the Cloud Attack Surface

During internal engagements, S3Scanner with -provider custom probes internal MinIO deployments or cloud-adjacent storage that standard AWS tools ignore. The -json output feeds directly into your reporting pipeline, with machine-readable evidence for your deliverables.

Cloud Security Posture Management (CSPM) at Startup Scale

Enterprise CSPM tools cost thousands monthly. For teams building security discipline without enterprise budgets, S3Scanner provides core bucket auditing capabilities. Schedule it via cron, store results in Postgres, and build Grafana dashboards. You've built a CSPM for the cost of a coffee instance.

Compliance and Data Governance Audits

GDPR, HIPAA, SOC 2—every framework demands knowing where sensitive data lives. S3Scanner's enumeration capability (-enumerate) reveals shadow IT buckets created outside approved processes. The PostgreSQL output creates audit trails that satisfy examiner questions about "how do you know you found everything?"

M&A Technical Due Diligence

Acquiring a company? Their cloud footprint is probably messier than their financials. S3Scanner rapidly assesses the target's storage hygiene across any provider they use, surfacing risks that could become your liability post-close.

Step-by-Step Installation & Setup Guide

S3Scanner's installation story is refreshingly comprehensive. Choose your path:

Option 1: Package Managers (Fastest)

Kali Linux / Parrot OS:

apt install s3scanner

macOS with Homebrew:

brew install s3scanner

BlackArch:

pacman -S s3scanner

Windows with winget:

winget install s3scanner

NixOS (stable or unstable):

nix-shell -p s3scanner

Option 2: Go Install (Latest Version)

go install -v github.com/sa7mon/s3scanner@latest

Requires Go 1.20+. The -v flag provides verbose progress during compilation.

Option 3: Docker (Most Portable)

docker run ghcr.io/sa7mon/s3scanner

For persistent configurations and output directories, mount volumes:

docker run -v $(pwd)/config.yml:/config.yml -v $(pwd)/output:/output ghcr.io/sa7mon/s3scanner -bucket-file /output/names.txt

Option 4: Build from Source

git clone git@github.com:sa7mon/S3Scanner.git
cd S3Scanner
go build -o s3scanner .

The resulting binary will report dev as its version. For release builds, use the official distribution channels.

Configuration File Setup

Create config.yml in one of these locations: current directory, /etc/s3scanner/, or $HOME/.s3scanner/.

For database output:

db:
  uri: "postgresql://user:pass@db.host.name:5432/schema_name"

For RabbitMQ integration:

mq:
  queue_name: "aws"
  uri: "amqp://user:pass@localhost:5672"

For custom providers (example: Vultr Object Storage):

providers:
  custom: 
    address_style: "path"           # or "vhost" for virtual-hosted style
    endpoint_format: "https://$REGION.vultrobjects.com"
    insecure: false                  # set true to ignore SSL errors
    regions:
      - "ewr1"
      - "lax"

The $REGION placeholder is dynamically replaced for each listed region, generating complete endpoint URLs at runtime.

REAL Code Examples from S3Scanner

Let's walk through actual usage patterns from the repository, with detailed explanations of what each command accomplishes and how to extend it.

Example 1: Basic File-Based Scanning with Object Enumeration

# Scan AWS for bucket names listed in a file, enumerate all objects
$ s3scanner -bucket-file names.txt -enumerate

Before running this: Create names.txt with one bucket name per line. These might come from subdomain enumeration (many S3 buckets mirror domain names), wordlist generation, or discovered references in JavaScript^{↗ Bright Coding Blog} files and API responses.

What happens under the hood:

• S3Scanner spawns 4 concurrent workers (default -threads)
• Each worker checks bucket existence and probes all permission combinations
• With -enumerate, existing buckets trigger paginated LIST operations (1,000 objects per page)
• Safety limit: enumeration halts after 5,000 pages (5 million objects) to prevent runaway operations against massive buckets

Output interpretation: Human-readable console logs show permission status for each bucket. Look for Read: true or Full Control: true—these are your immediate action items.

Example 2: GCP Scanning with Database Persistence

# Scan a bucket in GCP, enumerate all objects, and save results to database
$ s3scanner -provider gcp -db -bucket my-bucket -enumerate

The -provider gcp flag switches from AWS endpoints to Google Cloud Storage's S3-compatible interface. GCS uses different region conventions and authentication flows, but S3Scanner abstracts these differences.

The -db flag requires the db.uri config key. When active:

• Results persist to PostgreSQL via GORM's Auto Migration
• Console output continues simultaneously (unless redirected)
• Schema tables are created/updated automatically

Critical production note: The documentation warns that GORM's Auto Migration may modify existing tables if names collide. Always dedicate a separate schema for S3Scanner results to prevent interference with application databases.

Example 3: JSON Output Pipeline with jq Processing

# Print bucket name and region for all buckets that exist
$ s3scanner -bucket-file names.txt -json | jq -r '. | select(.bucket.exists==1) | [.bucket.name, .bucket.region] | join(" - ")'

Sample output:

10000 - eu-west-1
10000.pizza - ap-southeast-1
images_staging - us-west-2

Why this pattern is powerful:

• -json emits one JSON object per line (newline-delimited JSON / NDJSON)
• This format streams efficiently and parses incrementally
• jq filters extract precisely the fields you need
• Pipe to tee, grep, or downstream APIs for automated response workflows

The .bucket.exists==1 filter is crucial—it eliminates negative results, showing only confirmed buckets. For security workflows, you might instead filter for .permissions.read==true to find immediately exploitable exposures.

Example 4: Multi-Threaded Custom Provider Scanning

# Scan internal MinIO with 8 threads, verbose logging for debugging
$ s3scanner -provider custom -threads 8 -verbose -bucket-file internal-buckets.txt

When to use this: Internal object storage—MinIO deployments, Ceph clusters, or vendor-specific S3 gateways—often lack the monitoring and hardening of public cloud offerings. The custom provider with config.yml endpoints lets S3Scanner audit these shadow infrastructure components.

The -verbose flag generates substantial debug output. Reserve this for:

• Troubleshooting provider connectivity issues
• Filing bug reports with complete context
• Developing new provider configurations

Performance note: While -threads 8 doubles concurrent bucket checks, remember that object enumeration remains single-threaded per bucket. For maximum throughput on many small buckets, increase threads. For deep inspection of massive buckets, threads won't accelerate enumeration.

Example 5: RabbitMQ-Driven Continuous Monitoring

# Connect to message queue for automated bucket scanning
$ s3scanner -mq

Architecture context: This transforms S3Scanner from a point-in-time tool into a continuous security sensor. A typical deployment:

1. Ingestion service discovers bucket names from cloud APIs, DNS logs, or code repositories
2. Publisher (see cmd/mqingest/mqingest.go) formats JSON Bucket objects and sends to queue
3. S3Scanner workers consume messages, scan, and optionally persist to database
4. Alerting layer triggers on high-risk findings

Required config:

mq:
  uri: "amqp://scanner:SecurePass123@mq.internal:5672"
  queue_name: "production-buckets"

This pattern scales horizontally—add more S3Scanner consumers as your bucket discovery volume grows.

Advanced Usage & Best Practices

Optimize Your Wordlists

Bucket naming often follows predictable patterns: {company}-backups, {app}-staging, {project}-data. Combine DNS enumeration (subfinder, amass) with permutation tools (altdns) to generate high-probability bucket names. S3Scanner's deduplication handles overlaps automatically.

Rate Limiting and Responsible Disclosure

While S3Scanner is multi-threaded, respect provider limits. AWS S3 ListBucket calls are rate-limited; excessive scanning from a single IP may trigger throttling or account review. For large-scale assessments, distribute across multiple IPs or use the RabbitMQ architecture with deliberate pacing.

Correlate with Additional Reconnaissance

S3Scanner findings gain context when combined with:

• Subdomain enumeration — map bucket names to owning services
• GitHub code search — find hardcoded bucket references in public repositories
• Wayback Machine — discover historical bucket URLs in archived pages
• Certificate Transparency logs — identify infrastructure that likely uses cloud storage

Automate with CI/CD

Integrate S3Scanner into deployment pipelines to catch misconfigurations before production:

# Example GitLab CI snippet
s3-security-scan:
  image: ghcr.io/sa7mon/s3scanner
  script:
    - echo "$DEPLOYMENT_BUCKET" > bucket.txt
    - s3scanner -bucket-file bucket.txt -json -enumerate > results.json
  artifacts:
    reports:
      dotenv: results.json

Database Schema Isolation

Never use S3Scanner's -db against production application schemas. GORM's Auto Migration is convenient but potentially destructive. Create dedicated schemas or entirely separate database instances for security tooling data.

Comparison with Alternatives

The verdict: For single-cloud, one-off checks, AWS CLI suffices. For professional security work—multi-cloud environments, continuous monitoring, integration with broader toolchains—S3Scanner's architecture and ecosystem integration make it the clear choice.

Frequently Asked Questions

Is S3Scanner legal to use?

Yes, when used on infrastructure you own or have explicit written authorization to test. The tool itself is a security scanner—legal application depends on your permission scope. Never scan third-party buckets without authorization; this constitutes unauthorized access under laws like the CFAA.

Does S3Scanner require AWS credentials?

No. S3Scanner primarily tests anonymous/public access permissions. For authenticated testing of specific IAM policies, you would need credentials, but the core misconfiguration detection works without them—exactly how real attackers operate.

Can S3Scanner modify bucket permissions or delete data?

No. S3Scanner is read-only for enumeration and permission checking. It probes access levels but never writes ACLs, uploads files, or deletes objects. However, if a bucket has open Write permissions, understand that others can modify it.

How does S3Scanner handle rate limiting?

The tool respects standard HTTP response codes. If a provider returns 429 (Too Many Requests) or 503 (Service Unavailable), S3Scanner will surface these errors. For large-scale scanning, reduce -threads, implement backoff in your orchestration, or distribute across multiple egress points.

What data does S3Scanner store?

By default, results print to stdout only. With -db, scan metadata persists to your configured PostgreSQL instance. No telemetry or external reporting occurs—this is fully self-hosted open source.

Can I scan non-public buckets with S3Scanner?

S3Scanner's primary purpose is finding misconfigured public/anonymous access. For buckets requiring authentication, you would need valid credentials for that provider, and the tool's utility diminishes—AWS IAM policies are better audited with tools like Prowler or ScoutSuite.

How do I contribute new cloud providers?

The custom provider system (-provider custom with config.yml) handles most S3-compatible APIs without code changes. For providers needing special handling, the repository welcomes contributions—review the mitm development profile to capture and analyze provider-specific HTTP behavior.

Conclusion: Your Cloud Storage Deserves Better Than Hope

Misconfigured S3 buckets aren't edge cases—they're epidemic. They're the low-hanging fruit that script kiddies harvest with automated scanners, the silent data breach waiting for a journalist's DMs, the compliance violation that surfaces during due diligence and kills deals.

Hope is not a security strategy.

S3Scanner gives you the visibility to replace hope with certainty. Multi-cloud coverage means no provider escapes audit. Multi-threaded performance means scale without sacrifice. PostgreSQL and RabbitMQ integration mean it fits enterprise workflows, not just solo hacker laptops. And its adoption by reconftw, reNgine, and Axiom proves it's battle-tested where it matters.

Whether you're hunting bounties, hardening production infrastructure, or building a security program from scratch, S3Scanner belongs in your toolkit. The installation takes minutes. The first scan takes seconds. The peace of mind? That's the return on investment that keeps paying.

Stop wondering if your buckets are exposed. Start knowing.

👉 Get S3Scanner now: https://github.com/sa7mon/S3Scanner

Star the repo. Read the wiki. Join the discussions. And sleep better knowing your cloud storage isn't tomorrow's headline.