intro to cloud hacking (leaky buckets)

About this video

NetworkChuck gives an ethical-only introduction to hacking AWS S3, framing misconfiguration — ’leaky buckets’ — as the core problem and citing past S3 breaches involving US voter records, WWE, Verizon and Time Warner Cable mentioned in coverage he links. He shows how S3 works by creating his own bucket, noting modern defaults block public access and enable encryption but older buckets lack them, and that complex JSON bucket policies make mistakes easy. He then walks through Scott Piper’s flaws.cloud CTF: Level 1 uses nslookup and reverse DNS to confirm the site is hosted on S3, then aws s3 ls and aws s3 cp with --no-sign-request to list and download a secret file from a public bucket. Level 2 requires a free AWS account and IAM user; the bucket denies anonymous access but allows any authenticated AWS user, so listing with --profile succeeds. Level 3 syncs a bucket, finds a hidden .git directory, uses git logs to find a commit where access keys were accidentally added, checks out that commit to recover the keys, configures a new profile, and lists that account’s other buckets. He stops before levels 4-6 and demos installing AWS Bucket Dump to search many buckets automatically.

Key takeaways

• Most S3 hacks are misconfigurations, not AWS break-ins: public access, overly broad policies, and complex JSON policies cause leaky buckets
• Use nslookup / reverse DNS to test if a domain points to S3, then try aws s3 ls s3://<bucket> --no-sign-request for public buckets
• A bucket set to allow ‘any authenticated AWS user’ is effectively public to anyone with any AWS account — test with your own profile credentials
• Exposed .git directories can leak history: sync the bucket, inspect git logs, and check out an earlier commit to recover accidentally committed access keys
• Only hack with explicit permission; tools like Gray Hat Warfare and AWS Bucket Dump can search/download from many buckets, so use them ethically and carefully

Episode details: published July 10, 2023 · 26:02 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: how to HACK a password // Windows Edition · Next: you need this FREE CyberSecurity tool →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube