Identifying the AWS Account ID from a Public S3 Bucket is a PwnedLabs beginner lab that focuses on discovering and attributing AWS cloud assets from public web footprinting. Initial reconnaissance of the IP address identifies an Apache web server referencing image assets stored in an Amazon S3 bucket named mega-big-tech. Querying the root bucket URL confirms unauthenticated s3:ListBucket and s3:GetObject permissions. Using the open-source tool s3-account-search alongside a controlled IAM role, condition-key policy evaluation was performed against the public bucket. Sequential digit-by-digit prefix probing isolated the target AWS Account ID as 107513503799, establishing the account boundary required for subsequent cloud security auditing.
1. Scenario
The ability to expose and leverage even the smallest oversights is a coveted skill. A global Logistics Company has reached out to our cybersecurity company for assistance and have provided the IP address of their website. Your objective? Start the engagement and use this IP address to identify their AWS account ID via a public S3 bucket so we can commence the process of enumeration.
2. Web Reconnaissance & Unauthenticated S3 Bucket Discovery
2.1 Host & Service Enumeration
After adding 54.204.171.32 logistics.pwnedlabs to my /etc/hosts file, I ran nmap logistics.pwnedlabs -sC -sV -O -oN nmap_scan -Pn to discover the open services and ports.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-26 05:57 -0400 Nmap scan report for logistics.pwnedlabs (54.204.171.32) Host is up (0.26s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.52 ((Ubuntu)) |_http-title: Mega Big Tech |_http-server-header: Apache/2.4.52 (Ubuntu) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Linux 2.6.X|3.X (85%) OS CPE: cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:3.10 Aggressive OS guesses: Linux 2.6.32 (85%), Linux 2.6.32 or 3.10 (85%) No exact OS matches for host (test conditions non-ideal). OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 51.53 seconds
Navigating to http://logistics.pwnedlabs renders a static website.
I was not able to find any interesting information from the website, but reviewing the source code revealed that the images of the website are stored in an AWS S3 bucket.
<div class="grid-product"> <img src="https://mega-big-tech.s3.amazonaws.com/images/workpro1.jpg"> <div class="grid-detail"> <p>WorkPro</p> <p>From $5,000</p> </div> </div> <div class="grid-product"> <img src="https://mega-big-tech.s3.amazonaws.com/images/workpro2.jpg"> <div class="grid-detail"> <p>WorkPro Ultra</p> <p>From $7,900</p> </div> </div> <div class="grid-product"> <img src="https://mega-big-tech.s3.amazonaws.com/images/workpro3.jpg"> <div class="grid-detail"> <p>WorkPro Design</p> <p>From $9,900</p> </div> </div>
2.2 S3 Bucket Access Control & Permission Testing
I tried to list the bucket contents using the browser itself. Even though https://mega-big-tech.s3.amazonaws.com/images/ throws an Access Denied exception, I was able to list all the bucket contents in XML format by visiting https://mega-big-tech.s3.amazonaws.com/.
<ListBucketResult> <Name>mega-big-tech</Name> <Prefix/> <Marker/> <MaxKeys>1000</MaxKeys> <IsTruncated>false</IsTruncated> <Contents> <Key>images/</Key> <LastModified>2023-06-25T22:40:57.000Z</LastModified> <ETag>"d41d8cd98f00b204e9800998ecf8427e"</ETag> <Size>0</Size> <StorageClass>STANDARD</StorageClass> </Contents> ..... <Contents> <Key>images/workpro4.jpg</Key> <LastModified>2023-06-25T22:42:56.000Z</LastModified> <ETag>"9a70d62b2f2bd2bf6604943bde09f6bd"</ETag> <Size>1144134</Size> <StorageClass>STANDARD</StorageClass> </Contents> </ListBucketResult>
After authenticating with the AWS CLI as s3user, I successfully listed the objects anonymously.
{
"UserId": "AIDAWHEOTHRF62U7I6AWZ",
"Account": "427648302155",
"Arn": "arn:aws:iam::427648302155:user/s3user"
}2023-06-25 18:40:57 0 images/ 2023-06-25 18:42:34 3184176 images/banner.jpg 2023-06-25 18:42:35 941294 images/notepro1.jpg 2023-06-25 18:42:36 1660205 images/notepro2.jpg 2023-06-25 18:42:37 490794 images/notepro3.jpg 2023-06-25 18:42:38 2415092 images/notepro4.jpg 2023-06-25 18:42:39 1003564 images/phonepro1.jpg 2023-06-25 18:42:40 1277058 images/phonepro2.jpg 2023-06-25 18:42:41 2322525 images/phonepro3.jpg 2023-06-25 18:42:42 4080373 images/phonepro4.jpg 2023-06-25 18:42:43 1160096 images/watchpro1.jpg 2023-06-25 18:42:44 2877784 images/watchpro2.jpg 2023-06-25 18:42:46 3232387 images/watchpro3.jpg 2023-06-25 18:42:47 3041540 images/watchpro4.jpg 2023-06-25 18:42:49 3400957 images/watchpro5.jpg 2023-06-25 18:42:50 1632585 images/workpro1.jpg 2023-06-25 18:42:51 1081259 images/workpro2.jpg 2023-06-25 18:42:54 1599810 images/workpro3.jpg 2023-06-25 18:42:56 1144134 images/workpro4.jpg
Based on the results:-
- Bucket name is
mega-big-tech - Public read access (
s3:ListBuckets3:GetObject/s3:GetObject) is active
3. AWS Account ID Brute-Forcing
3.1 Mechanics of Condition-Key Account ID Enumeration
Even though AWS S3 bucket names are globally unique, they do not expose the AWS Account ID that they belong to. However, when an S3 bucket grants read permissions (s3:ListBuckets3:GetObject / s3:GetObject) to an external entity or anonymously, the external entity can enumerate the owning Account ID using IAM condition-key evaluation mechanics.
3.2 Automated Brute-Forcing & Account ID Recovery
To install the automated tool s3-account-search, I had to create a Python virtual environment to install required packages without breaking my host dependencies.
python3 -m venv .venv source .venv/bin/activate python3 -m pip install s3-account-search
After the successful installation, I was able to run the tool and retrieve the AWS Account ID.
Starting search (this can take a while) found: 1 found: 10 found: 107 found: 1075 found: 10751 found: 107513 found: 1075135 found: 10751350 found: 107513503 found: 1075135037 found: 10751350379 found: 107513503799
The tool successfully evaluates candidate numerical prefixes digit-by-digit, isolating 107513503799 as the 12-digit AWS Account ID hosting the public S3 bucket.
