Public Storage Buckets

What Is Public Storage Buckets?

An object store open to anonymous read is a public website you did not know you published, and nobody knowing the URL is not access control. This exercise covers the whole path: watch an attacker find a bucket, list it without credentials, and download what is inside, then close it properly with account-level public-access blocking, a policy that names principals, and a verification that the same anonymous request now fails.

What You'll Learn in Public Storage Buckets

• Bucket names are guessable and scanned continuously. Obscurity is not access control.
• Anonymous read on a bucket holding an export is a complete breach in one request, with no rate limit to slow it.
• Fix at the account level with block-public-access, not just on the one bucket that was found.
• Prove the fix by re-running the identical anonymous request and confirming it is denied.

Public Storage Buckets — Training Steps

1. A host in a support page

   Bob is targeting Orbrandt, a company whose software runs the appointment books and client records of several hundred veterinary practices. He has no credentials and no foothold, and he is not looking for one yet. He starts where anyone can: the parts of the company that are meant to be public.

2. Allowlist this host

   The page is exactly what it claims to be: printable consent forms and import templates for clinics. Useful, dull, and entirely intended to be public. One support note on it is more interesting than the forms.

3. Ask it for a list

   A bucket that serves files is one thing. A bucket that will enumerate its own contents to a stranger is another, and the two are separate permissions that people routinely grant together by accident. Bob asks for the listing with no credentials at all.

4. What is in exports

   The forms prefix is the one the company meant to publish. Bob goes straight past it.

5. A website nobody published

   The command line is Bob's habit, but it is not required. The same permission answers an ordinary browser, which is worth seeing, because it is how this kind of exposure is usually found by someone who was not even looking.

6. No login, no key, just a URL

   No credential was offered and none was asked for. The bucket returned its own index to an anonymous browser.

7. Take a copy

   Listing a bucket tells an attacker what exists. Reading from it is a separate permission, and Orbrandt granted that one too.

8. What was in it

   Up to now this has been file names and byte counts. Bob opens the top of the file to see what he actually took.

9. Why it worked

   Bob closes the laptop with a copy of every client record Orbrandt holds.

10. Someone else found it too

    Nine days pass. Nobody at Orbrandt notices anything, because an anonymous read leaves nothing in an inbox to notice. Then a researcher finds the same bucket and does the responsible thing with it.