Information Gathering

Bucket Stream – Find interesting Amazon S3 Buckets by watching certificate transparency logs

Some quick tips if you use S3 buckets:

  1. Randomise your bucket names! There is no need to use
  2. Set appropriate permissions and audit regularly. If possible create two buckets – one for your public assets and another for private data.
  3. Be mindful about your data. What are suppliers, contractors and third parties doing with it? Where and how is it stored? These basic questions should be addressed in every info sec policy.

Python 3.4+ and pip3 are required. Then just:

  1. git clone
  2. (optional) Create a virtualenv with pip3 install virtualenv && virtualenv .virtualenv && source .virtualenv/bin/activate
  3. pip3 install -r requirements.txt
  4. python3

Simply run python3
If you provide AWS access and secret keys in config.yaml Bucket Stream will attempt to identity the buckets owner.

usage: python3

Find interesting Amazon S3 Buckets by watching certificate transparency logs.

optional arguments:
  -h, --help           show this help message and exit
  --only-interesting   Only log 'interesting' buckets whose contents match
                       anything within keywords.txt (default: False)
  --skip-lets-encrypt  Skip certs (and thus listed domains) issued by Let's
                       Encrypt CA (default: False)
  -t , --threads       Number of threads to spawn. More threads = more power.
                       (default: 20)


  • Nothing appears to be happening
    Patience! Sometimes certificate transparency logs can be quiet for a few minutes.
  • I found something highly confidential
    Report it – please! You can usually figure out the owner from the bucket name or by doing some quick reconnaissance. Failing that contact Amazon’s support teams.


About the author

Mazen Elzanaty

Add Comment

Click here to post a comment

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: