Exploiting S3 buckets doesn't end at reading sensitive information. For instance, JavaScript contained in an S3 bucket can be backdoored to affect all users of a web application that load an infected JavaScript.
This chapter goes through the process of exploiting a vulnerable S3 bucket to identify JS files that are being loaded by a web application and backdooring them to gain pan-user compromise. In addition to this, there is also a focus on identifying sensitive credentials and other data secrets stored within the vulnerable S3 buckets and using these for achieving further compromise in connected applications.
In this chapter, we will cover the following topics:
- Extracting sensitive data from exposed S3 buckets
- Injecting malicious code into S3 buckets
- Backdooring S3 buckets for persistent access
