id: s3-detect

info:
  name: Detect Amazon-S3 Bucket
  author: melbadry9
  severity: info
  tags: aws,s3,bucket,tech

requests:
  - method: GET
    path:
      - "{{BaseURL}}/%c0"

    matchers-condition: or
    matchers:
      - type: regex
        part: body
        regex:
          - "(?:InvalidURI|InvalidArgument|NoSuchBucket)"

      - type: dsl
        dsl:
          - 'contains(to_lower(server), "amazons3")'
          - 'contains(to_lower(header), "x-amz-id")'
          - 'contains(to_lower(header), "x-amz-request-id")'