Question

During the reconnaissance phase of an authorized cloud assessment for a retail company, a penetration tester wants to discover publicly exposed AWS S3 buckets belonging to the target without generating traffic directly against the client's production infrastructure. The tester has the company name, brand names, and common naming conventions the organization uses. Which approach BEST supports passive discovery of exposed storage buckets while minimizing direct interaction with the target?

Accepted Answer

Use a bucket-name permutation wordlist generated from the company and brand names, then check for buckets via third-party search engines and public bucket indexes before any direct requests

Answer

Run an Nmap TCP connect scan against the AWS IP ranges published in the AWS ip-ranges.json file

Answer

Perform an authenticated aws s3 ls command using the tester's own AWS credentials to list all of the client's buckets

Answer

Launch a Nessus credentialed scan configured with the AWS connector against the client's account