0Pricing
Ethical Hacking Academy · Lesson

S3 and Storage Exposure

Public buckets.

S3 and Storage Exposure is a free Ethical Hacking Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Storage Buckets Leak

Object storage like AWS S3, Azure Blob, and GCP Cloud Storage is one of the most common sources of cloud data breaches. Buckets are easy to create and easy to misconfigure.

  • Accidentally set to public read or write
  • Predictable names that can be guessed
  • Overly broad bucket policies or ACLs

A single public bucket can leak millions of records.

How S3 Naming Works

S3 bucket names are globally unique and map to predictable URLs. This predictability is exactly what makes enumeration possible.

Anyone who guesses a valid bucket name can probe its access level.

# Two equivalent S3 URL forms
https://my-bucket.s3.amazonaws.com/
https://s3.amazonaws.com/my-bucket/

# Region-specific endpoint
https://my-bucket.s3.eu-west-1.amazonaws.com/

Detecting Public Buckets

The fastest test is an unauthenticated request. The HTTP status code tells you the access state.

  • 200 with an XML listing — public list access
  • 403 AccessDenied — bucket exists but is private
  • 404 NoSuchBucket — does not exist
# Anonymous listing attempt
curl -s https://example-data.s3.amazonaws.com/

# Anonymous via the AWS CLI (no signing)
aws s3 ls s3://example-data --no-sign-request

Bucket Name Brute-Forcing

Attackers generate candidate names from the company name plus common suffixes and test each one. Tools automate this at scale.

Typical patterns: company-backups, company-dev, company-logs, company-assets.

# Permutate and probe bucket names from a keyword
cloud_enum -k example

# Dedicated S3 enumerator
s3scanner scan --bucket-file candidates.txt

Public Read vs Public Write

Public access comes in two flavours, and write is far worse than read.

  • Public read — attackers download your data (data breach)
  • Public write — attackers upload or overwrite objects

Public write enables defacement, malware hosting on your domain, and even supply-chain attacks if the bucket serves website or software assets.

# Test for public write (DANGEROUS - only with authorization)
aws s3 cp test.txt s3://example-data/ --no-sign-request

# If this succeeds, the bucket allows anonymous uploads.

Misleading 'Block Public Access'

AWS offers Block Public Access settings at both the account and bucket level. They are powerful but often misunderstood.

  • Account-level settings override bucket policies
  • A bucket can be private even with a permissive policy if BPA is on
  • Conversely, disabling BPA can suddenly expose many buckets

Always check the effective access, not just one policy.

# Inspect block-public-access configuration
aws s3api get-public-access-block --bucket example-data
aws s3api get-bucket-policy-status --bucket example-data

Azure Blob Exposure

Azure stores objects in containers inside storage accounts. Misconfiguration sets a container's public access level to blob or container.

Storage account names are also globally unique and predictable.

# Azure blob URL pattern
https://exampleacct.blob.core.windows.net/container/file.txt

# Anonymous list attempt against a public container
curl -s 'https://exampleacct.blob.core.windows.net/backups?restype=container&comp=list'

GCP Cloud Storage Exposure

Google Cloud Storage buckets can be made public by granting the allUsers or allAuthenticatedUsers principal a read role.

The exposure pattern mirrors S3: predictable names, anonymous probing, public IAM bindings.

# Anonymous list of a GCS bucket
curl -s https://storage.googleapis.com/example-bucket/

# Check IAM bindings for allUsers (authenticated)
gsutil iam get gs://example-bucket

What Attackers Look For Inside

A public bucket is only the door. The real prize is what is inside:

  • Database dumps and backups
  • Source code and .env files with secrets
  • Cloud credentials and API keys
  • Customer PII (personal data)
  • Internal documents and configs

Even a small leaked file can contain keys that escalate into full account access.

Remediation and Hardening

The fix for storage exposure is layered:

  • Enable Block Public Access at the account level
  • Remove public ACLs and allUsers / allAuthenticatedUsers grants
  • Use bucket policies scoped to specific principals
  • Enable encryption and access logging
  • Run continuous config scanning to catch new public buckets

Handle Exposed Data Responsibly

Finding a public bucket full of real data carries ethical and legal weight.

  • Do not download more than the minimum needed to prove exposure
  • Never exfiltrate or retain customer PII
  • Report immediately and securely
  • Stay within the scope and rules of engagement

Proving access exists is the goal, not collecting the data.

Quick Check

An anonymous request to an S3 bucket URL returns HTTP 403 AccessDenied. What does this indicate?

Recap: S3 and Storage Exposure

You learned how object storage leaks and how to test for it safely.

  • Bucket names are globally unique and predictable, enabling enumeration
  • HTTP status codes reveal access state: 200 (public), 403 (private), 404 (none)
  • Public write is more dangerous than public read
  • The same pattern applies to Azure Blob and GCP Cloud Storage
  • Remediate with Block Public Access and least-privilege policies

Next: metadata services and SSRF, a cloud-specific attack chain.

Frequently asked questions

Is the “S3 and Storage Exposure” lesson free?

Yes — the full text of “S3 and Storage Exposure” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “S3 and Storage Exposure”?

Public buckets. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “S3 and Storage Exposure” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Cloud Attack Surface
  2. IAM Misconfigurations
  3. S3 and Storage Exposure
  4. Metadata and SSRF
← Back to Ethical Hacking Academy