S3 buckets can sometimes be left unclaimed. That is, there may be applications and/or scripts that make requests to S3 buckets that do not exist.
To demonstrate such a scenario, let's assume an S3 bucket URL (http://s3bucket.example.com.s3-website.ap-south-1.amazonaws.com).
This URL may be bound to a subdomain (for example, https://data.example.net) belonging to the organization to obfuscate the AWS S3 URL. This is done by adding an alternate domain name (CNAMEs).
However, in the course of time, the bucket bound to the URL, https://data.example.net, might be deleted but the CNAMEs record would remain. As a result, an attacker could create an S3 bucket with the same name as the unclaimed bucket and upload malicious files to be served. When a victim visited the URL, he would be served with malicious content.
How do you identify this...
