Skip to content

Move s3:PutBucketNotification from S3 enum to S3 post-exploitation - #400

Merged
carlospolop merged 2 commits into
masterfrom
s3-putbucketnotification-postexpl
Sep 18, 2026
Merged

carlospolop merged 2 commits into
masterfrom
s3-putbucketnotification-postexpl

Conversation

@carlospolop

Copy link
Copy Markdown
Collaborator

What

Moves the s3:PutBucketNotification — wire future objects into a pre-authorized Lambda technique out of the S3 enumeration page and into the S3 post-exploitation page.

  • Source: aws-services/aws-s3-athena-and-glacier-enum.md
  • Destination: aws-post-exploitation/aws-s3-post-exploitation/README.md, under Pivoting (right after the s3:PutObject → SSM AWS-RunRemoteScript object-overwrite technique it most resembles)

Why

s3:PutBucketNotification isn't enumeration — it's a cross-service, delayed code-execution / pivot primitive (route later objects into an already-authorized Lambda and its execution role). It belongs alongside the other object-overwrite → execution pivots in the post-exploitation page.

Details

  • Section content moved verbatim; heading demoted ####### to sit under Pivoting.
  • Its two references were removed from the enum reference list ([38], [39]) and re-added to the post-exploitation reference list as [29], [30], with the inline <sup> markers updated to match.
  • Net change is a pure move: 44 insertions / 44 deletions.

🤖 Generated with Claude Code

carlospolop and others added 2 commits September 18, 2026 15:51
…itation

The `s3:PutBucketNotification` — wire future objects into a pre-authorized
Lambda technique is a cross-service execution/pivot primitive, not
enumeration. Move it from the S3 Athena/Glacier enum page into the S3
Post-Exploitation page under Pivoting (next to the SSM AWS-RunRemoteScript
object-overwrite technique), renumbering its two references into the
post-exploitation reference list and dropping them from the enum list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Document abusing s3:PutBucketWebsite to rewrite a bucket's static-website
config (RedirectAllRequestsTo / conditional RoutingRules) to redirect a
site's visitors to an attacker host for phishing/defacement or to steal
secrets carried in the request URL, with no s3:PutObject. Placed under
Pivoting next to PutBucketNotification, including the website-endpoint vs
REST-endpoint caveat and references [31]-[34].

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@carlospolop
carlospolop merged commit 710d882 into master Sep 18, 2026
@carlospolop
carlospolop deleted the s3-putbucketnotification-postexpl branch September 18, 2026 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant