MinIO and S3-Compatible Storage

Default Ports: 9000 (API), 9001 (Console), 80/443 (S3 Gateways)

MinIO and S3-compatible storage services store objects inside buckets. In pentests, misconfigured buckets can expose backups, uploads, logs, CI artifacts, static files, model files, and secrets.

Connect

Using AWS CLI

AWS CLI works with S3-compatible endpoints by setting --endpoint-url.

aws --endpoint-url http://target.com:9000 s3 ls
aws --endpoint-url http://target.com:9000 s3 ls s3://bucket-name
aws --profile pentest --endpoint-url http://target.com:9000 s3 ls

Using MinIO Client

mc is the native MinIO client for bucket and object operations.

mc alias set target http://target.com:9000 ACCESS_KEY SECRET_KEY
mc alias set target http://target.com:9000
mc ls target
mc ls target/bucket-name

Using s3cmd

s3cmd is useful for older S3-compatible workflows.

s3cmd --host=target.com:9000 --host-bucket=target.com:9000 ls
s3cmd --host=target.com:9000 --host-bucket=target.com:9000 ls s3://bucket-name

Using HTTP Requests

Direct HTTP requests show S3-style XML errors and public object access.

curl -i http://target.com:9000/
curl -i http://target.com:9000/bucket-name/
curl -I http://target.com:9000/bucket-name/object.txt

Recon

Service Detection with Nmap

Scan MinIO API, console, and reverse proxy ports.

nmap -p 80,443,9000,9001,9443 -sV target.com
nmap -p 9000,9001 --script http-title,http-headers target.com
nmap -p 443,9000,9001,9443 --script ssl-cert,ssl-enum-ciphers target.com

Endpoint Discovery

S3-compatible APIs often return XML errors such as AccessDenied or NoSuchBucket.

curl -i http://target.com:9000/
curl -i http://target.com:9001/
curl -i https://storage.target.com/
curl -s http://target.com:9000/ | head

Bucket Name Discovery

Test likely bucket names based on organization, app, and environment.

for b in backup backups prod staging dev logs uploads assets; do
  aws --endpoint-url http://target.com:9000 s3 ls s3://$b
done

Console Fingerprinting

The console can expose MinIO version and login behavior.

curl -I http://target.com:9001/
httpx -u http://target.com:9001 -title -tech-detect -status-code

Enumeration

Anonymous Bucket Listing

Anonymous listing is the first storage misconfiguration to validate.

aws --no-sign-request --endpoint-url http://target.com:9000 s3 ls
aws --no-sign-request --endpoint-url http://target.com:9000 s3 ls s3://bucket-name
mc anonymous list http://target.com:9000/bucket-name

Object Enumeration

Object names often reveal backups, logs, credentials, and internal paths.

aws --no-sign-request --endpoint-url http://target.com:9000 s3 ls s3://bucket-name --recursive
mc ls --recursive target/bucket-name

Permission Enumeration

Check read, write, delete, and policy access separately.

aws --endpoint-url http://target.com:9000 s3 cp test.txt s3://bucket-name/pentest-test.txt
aws --endpoint-url http://target.com:9000 s3 rm s3://bucket-name/pentest-test.txt
mc anonymous get target/bucket-name
mc anonymous set download target/bucket-name

Policy Enumeration

Bucket policies show public or overly broad access.

aws --endpoint-url http://target.com:9000 s3api get-bucket-policy --bucket bucket-name
aws --endpoint-url http://target.com:9000 s3api get-bucket-acl --bucket bucket-name
mc anonymous get target/bucket-name

Versioning Enumeration

Versioning can expose deleted or older sensitive objects.

aws --endpoint-url http://target.com:9000 s3api get-bucket-versioning --bucket bucket-name
aws --endpoint-url http://target.com:9000 s3api list-object-versions --bucket bucket-name

Attack Vectors

Public Read Access

Public reads can expose large object collections.

aws --no-sign-request --endpoint-url http://target.com:9000 s3 ls s3://bucket-name --recursive
curl -I http://target.com:9000/bucket-name/object.txt

Public Write Access

Public writes can enable defacement, malware hosting, or data pollution.

echo "pentest" > pentest.txt
aws --no-sign-request --endpoint-url http://target.com:9000 s3 cp pentest.txt s3://bucket-name/pentest.txt

Leaked Access Keys

MinIO and S3 keys are often stored in configs and CI variables.

rg -n 'AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|MINIO_ROOT_USER|MINIO_ROOT_PASSWORD|endpoint-url|s3://' .
aws configure --profile leaked
aws --profile leaked --endpoint-url http://target.com:9000 s3 ls

Sensitive Object Exposure

Search object names and downloaded samples for obvious secrets.

aws --endpoint-url http://target.com:9000 s3 ls s3://bucket-name --recursive | grep -Ei 'backup|dump|secret|password|token|key|config|env|sql|zip|tar'
trufflehog filesystem downloaded-bucket/

Presigned URL Abuse

Presigned URLs may be overlong, leaked, or usable for unintended objects.

curl -I 'https://storage.target.com/bucket/object?X-Amz-Signature=...'
aws --endpoint-url http://target.com:9000 s3 presign s3://bucket-name/object.txt --expires-in 3600

Post-Exploitation

Bucket Impact Review

Summarize accessible buckets, object counts, and permissions.

aws --endpoint-url http://target.com:9000 s3 ls > buckets.txt
aws --endpoint-url http://target.com:9000 s3 ls s3://bucket-name --recursive > bucket-objects.txt
mc anonymous get target/bucket-name > bucket-policy.txt

Secret Review

Review small samples before broad downloads.

grep -Ei 'password|secret|token|apikey|private key|connection string' bucket-objects.txt
trufflehog filesystem downloaded-bucket/
gitleaks detect --source downloaded-bucket/

Backup Review

Backups and dumps commonly contain credentials and production data.

grep -Ei 'backup|dump|db|sql|mongo|postgres|mysql|redis|snapshot|archive' bucket-objects.txt

Useful Tools

Tool	Purpose
aws	AWS S3 API testing and bucket management
mc	MinIO-native client for object storage testing
s3cmd	S3-compatible storage testing and management
curl	HTTP requests and object accessibility checks
nmap	Port scanning and service detection
httpx	Web console fingerprinting
trufflehog / gitleaks	Secret and credential scanning

Security Misconfigurations

Misconfiguration	Risk
Anonymous bucket listing	Object inventory disclosure
Public object read	Sensitive file exposure
Public object write	Data tampering or malware hosting
Leaked access keys	Bucket or tenant compromise
Overly permissive bucket policies	Cross-user data exposure
Exposed MinIO management console	Credential theft and admin attack surface
Long-lived presigned URLs	Uncontrolled object access
Unencrypted backups	Secret and sensitive data leakage