Public S3 Bucket Hunt
cloud · easy · +30 XP
Target
GET /api/lab/s3-hunt-101/bucket?name=... (returns 200 + objects[] if public, 403 otherwise)
GET /api/lab/s3-hunt-101/object?bucket=...&key=...
Goal: the target org is acme-corp. Try common patterns (acme-corp-backups, acme-corp-dev, acme-corp-prod, acme-corp-uploads, acme.backup, etc.) — one of them is publicly readable. List its objects, find the one named secret.txt, and read it for the flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/s3-hunt-101/
// reuse on the cli
// submit flag
// no solves yet
// start of cloud
next
IAM Policy Audit
1 of 10 · cloud