id: s3-detect

info:
  name: Detect Amazon-S3 Bucket
  author: melbadry9
  severity: info
  metadata:
    max-request: 1
  tags: aws,s3,bucket,tech

http:
  - method: GET
    path:
      - "{{BaseURL}}/%c0"

    matchers-condition: or
    matchers:
      - type: regex
        part: body
        regex:
          - "(?:InvalidURI|InvalidArgument|NoSuchBucket)"

      - type: dsl
        dsl:
          - 'contains(to_lower(server), "amazons3")'
          - 'contains(to_lower(header), "x-amz-id")'
          - 'contains(to_lower(header), "x-amz-request-id")'

# digest: 4b0a00483046022100e4d62de5d67e017609c9e06ca9dcc8a840a222db5d65cb83201b7d13bb84dfa4022100efc723578b13403d1c4216dfc6add252cd5c7423d8e64045293962a21497a063:922c64590222798bb761d5b6d8e72950