In this post I am covering the challenge “A bucket load of Samosa” under the Cloud category from the BsidesMumbaiCTF competition.
For this challenge, we are provided with a wordlist (https://naughtydev-company-files.s3.eu-central-1.amazonaws.com/naughtydev-bucketnames.txt) and a whole lot of description about the chall. I decided to run ffuf with this wordlist on the naughtyide aws bucket provided and as you see in the output social.naughtyide.s3.amazonaws.com is identified
ffuf
After loading the bucket we get the following:
social.blah.blah.blah
We notice something in the key “COM/flag.txt” hinting towards the flag.txt file located in the “COM” directory. And there we have the Flag!
Flag!