Improve word and suffix lists (closes #50)#84
Open
anupddas wants to merge 2 commits into
Open
Conversation
Removed several entries and added new categories with associated keywords to the wordlist. CI/CD and IaC terms are added because these buckets, when exposed, tend to leak far more sensitive material (state files with secrets, build artifacts with embedded credentials) than the generic assets/uploads style buckets already in the list — and they're a growing pattern as more orgs adopt Terraform/K8s. Analytics/data pipeline terms reflect how companies commonly name buckets tied to Segment, Kinesis Firehose, and internal BI tooling — a category missing from the current list entirely. Secrets/credentials terms are intentionally included even though they sound alarming — they're standard in every major wordlist (SecLists, cloud_enum, etc.) precisely because misconfigured buckets with these exact names are a recurring, real-world finding that defenders and bug bounty hunters need to check for. I avoided adding highly specific company/product names to keep the list broadly applicable rather than tailored to one vendor.
Added additional suffixes to the suffix list. Environment suffixes (-prod, -dev, -staging, -uat) are the single highest-value category in real bucket-squatting/discovery reports — organizations very consistently create parallel buckets per environment. Region suffixes (-east, -west, -eu) reflect how multi-region deployments often duplicate a base bucket name per region. Year suffixes catch buckets created for annual snapshots/exports/campaigns, a pattern seen often in marketing/data-export buckets. I deliberately kept numeric suffixes short (v1, v2, 01, 02) rather than an exhaustive numeric range, since the tool already does prefix/suffix combination — an overly large suffix list multiplies total DNS queries linearly and works against the tool's stated "stealthy" design goal.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL/DR
Expand example word and suffix lists
Add ~60 word-list entries covering CI/CD, IaC/Terraform, Kubernetes, analytics pipelines, mobile/CDN delivery, and credentials naming patterns commonly seen in disclosed misconfigured S3 buckets.
Add environment, region, lifecycle, and version suffix entries to examples/suffixlist.txt.
Summary
This PR expands
examples/wordlist.txtandexamples/suffixlist.txtwith entries based on naming patterns commonly seen in publicly disclosed, misconfigured S3 buckets (bug bounty writeups, cloud security research, and existing OSS wordlists like SecLists/cloud_enum).What's added
-prod,-staging,-uat), region (-east,-west,-eu), lifecycle (-backup,-archive,-tmp), and versioning/year suffixes.Why
The current lists are strong for general web-app asset buckets (
uploads,static,cdn, etc.) but under-represent modern infra/tooling patterns that are increasingly common sources of accidental exposure.Notes for maintainer
baselines.
sort -u).you'd like a smaller default.
Testing
Ran
s3enum -wordlist examples/wordlist.txt -suffixlist examples/suffixlist.txt <test-target>locally against a throwaway bucket name to confirm no parsing regressions.Closes #50