S3 enum

Skill sunilgentyala/OmniRed/skills/cloud/s3-enum

AWS S3 and cloud storage enumeration methodology. Covers bucket discovery, access control testing, public data exposure, and cross-cloud (GCS, Azure Blob) equivalents.From its SKILL.md

Install

npx -y skills add sunilgentyala/OmniRed --skill s3-enum

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.0 KB, 501 tokens by cl100k_base, as published. Nobody here has run it

Cloud Storage Enumeration

AWS S3

Bucket Discovery

# Naming conventions to test
target.com
target-backups
target-logs
target-dev
target-staging
target-prod
target-assets
target-uploads
target-data
www.target.com
api.target.com

# Automated
gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  --wordlist-extra target,company
lazys3 --wordlist targets.txt

Access Testing

# Check if bucket is public
aws s3 ls s3://target-bucket --no-sign-request

# Download publicly accessible files
aws s3 sync s3://target-bucket . --no-sign-request

# Check ACLs (if you have credentials)
aws s3api get-bucket-acl --bucket target-bucket
aws s3api get-bucket-policy --bucket target-bucket

# List with authenticated credentials
aws s3 ls s3://target-bucket --profile attacker-profile

Misconfigurations to Test

# Write access (upload test)
echo "test" | aws s3 cp - s3://target-bucket/test.txt --no-sign-request

# Delete access
aws s3 rm s3://target-bucket/test.txt --no-sign-request

# Bucket takeover (if CNAME points to non-existent bucket)
aws s3api create-bucket --bucket deleted-bucket-still-cnamed

GCP Cloud Storage

# Check public access
gsutil ls gs://target-bucket
gsutil cat gs://target-bucket/sensitive-file.txt

# Check permissions
gsutil iam get gs://target-bucket

Azure Blob Storage

# Public containers
az storage blob list --container-name target-container \
  --account-name target --auth-mode anonymous

# URL pattern: https://account.blob.core.windows.net/container/blob

Tools

S3Scanner
lazys3
bucket-finder
GrayhatWarfare — public bucket search engine

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.