C-PUBLIC-BUCKET-HUNTReconnaissance

Public Bucket Hunting

Brute-force bucket names (S3, GCS, Azure Blob) via wordlists scoped to org name + common patterns; check ACL.

§ Where this technique fits

C-PUBLIC-BUCKET-HUNT is catalogued under the Reconnaissance tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

Public bucket → CI/CD secret leak → cloud takeover
A public S3 bucket hosts a build artefact containing CI tokens / .env files. Use them to push to the prod CI/CD pipeline and gain a deploy role.
step 1 / 7

§ What commonly comes next

01
S3 / Blob / GCS Mass Exfil
C-S3-EXFIL · Collection
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Public bucket → CI/CD secret leak → cloud takeover

§ What commonly comes next