AWS-Scanner

A high-performance security tool for discovering AWS S3 buckets and CloudFront distributions on target websites.

AWS-Scanner efficiently scans a list of URLs to identify exposed AWS resources including:

• Amazon S3 buckets
• CloudFront distributions

The scanner outputs clean CSV files with discovered resources for further analysis.

• ✅ Auto-detection of URL protocols (http/https)
• ✅ Smart JavaScript filtering to avoid parsing messy inline scripts
• ✅ Response size limiting (5MB) to prevent memory issues
• ✅ Unified regex engine for efficient pattern matching
• ✅ Deduplication of discovered resources
• ✅ Clean CSV output with normalized HTTPS URLs
• ✅ Request timeouts (30 seconds per site) to avoid hangs

• Go 1.24 or later

# Clone the repository
git clone https://github.com/random-robbie/AWS-Scanner.git
cd AWS-Scanner

# Download dependencies
go mod tidy

# Build the binary
go build -o aws-scanner main.go

go run main.go --list list.txt

Build the Docker image:

docker build -t aws-scanner .

Run the scanner with Docker:

# Mount your URL list and output directory, and set the working directory
# to the mounted output folder so the CSV files are written there
docker run -v $(pwd)/list.txt:/data/list.txt -v $(pwd)/output:/data -w /data aws-scanner --list list.txt

# The CSV files (s3-bucket.csv and cloudfront.csv) will be saved to ./output

Or use docker-compose (create a docker-compose.yml):

version: '3.8'
services:
  aws-scanner:
    build: .
    working_dir: /data
    volumes:
      - ./list.txt:/data/list.txt
      - ./output:/data
    command: --list list.txt

Then run:

docker-compose up

./aws-scanner --list list.txt

Scans run concurrently. Exit code 1 when at least one finding was written, so the scanner can drive pipelines:

./aws-scanner --list list.txt || ./notify-new-buckets.sh

Create a text file (list.txt) with one URL per line:

github.com
https://www.example.com
http://test.com

Note: URLs can be provided with or without protocol prefixes (http:// or https://). The scanner will automatically detect and normalize them.

The scanner generates two CSV files:

• s3-bucket.csv - Discovered S3 buckets
• cloudfront.csv - Discovered CloudFront distributions

Format: source_url,discovered_resource

Example:

https://github.com/,https://github-cloud.s3.amazonaws.com
https://example.com/,https://example-assets.cloudfront.net

• Unified regex function for cleaner codebase
• Auto-detection of URL protocols
• JavaScript and script tag filtering
• Response body size limiting
• Normalized HTTPS-only output
• Duplicate resource removal

Contributions are welcome! Please feel free to submit pull requests or open issues for bugs and feature requests.

See CONTRIBUTING.md for guidelines.

See LICENSE file for details.

Special thanks to Glove for contributions.

Use a VPS from DigitalOcean:

Robbie Wiggins — What-Security · GitHub

Disclaimer: This tool is intended for security research and authorised testing only. Always obtain proper authorisation before scanning any websites or networks you do not own.