id: s3cfg-config info: name: S3CFG Configuration - Detect author: geeknik,DhiyaneshDK severity: high description: S3CFG configuration file was detected. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cwe-id: CWE-200 reference: - https://s3tools.org/kb/item14.htm tags: amazon,s3,exposure,config requests: - method: GET path: - "{{BaseURL}}/.s3cfg" matchers-condition: and matchers: - type: word words: - "access_key" - "bucket_location" - "secret_key" condition: and - type: word part: header words: - "text/plain" - type: status status: - 200 # Enhanced by md on 2023/02/23