When it is useful?
If we found url that load from S3 Bucket image with .jpg
extation and we can takeover this bucket.
- Check bucket exist or not. Detection in response
NoSuchBucket
orThe specified bucket does not exist
- Takeover this bucket name
- Make bucket public: Permissions tab -> Block public access Edit -> uncheck
Block public access
- Download https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/Files/SVG_XSS.svg
- Rename
SVG_XSS.svg
toimg.jpg
, for example: in source we foundhttp://noneexixs.s3.amazonaws.com/img.jpg
- upload
img.jpg
to taken S3 bucket - Make this
img.jpg
public,U can do it, check file, tap on Action buttion and Make Public - Change Metadata: check again
img.jpg
, tap Action button -> Edit metadata, changeContent-Type fromimage/jpeg
toimage/svg+xml
- Open in browser
http://noneexixs.s3.amazonaws.com/img.jpg
Again open url where we found s3 bucket in a source and we will get XSS popup.
Happy Hunting!