cloud

NaughtyDev is launching a new product called ‘Naughtyide’.

The admins of 'Naughtyide' like to use a lot of AWS services, their favorite being Amazon S3.

However, they are very bad at security. There is news in the underground that someone has leaked some sensitive files into an S3 bucket but have poorly configured it making it available to the public.

Just some additional info, last week two buckets were discovered called 'admin.naughtyide' and 'hr.naughtyide'.

Note: Use this custom dictionary stolen from their servers to find the bucket and the flag file. You may have to edit the dictionary to align with the company's naming convention as shown above! Also the flag format for this challenge is BMCTF{flag}

https://naughtydev-company-files.s3.eu-central-1.amazonaws.com/naughtydev-bucketnames.txt

Author: @0xcriminal