" extractors: - type: regex name: aws_access_key_id part: body regex: - '((?:AKIA|ASIA)[0-9A-Z]{16})' group: 1

# AWS Credentials File Exposure Detection Module

id: aws-credentials-exposure
info:
  name: AWS Credentials File Exposure
  author: sif
  severity: high
  description: Detects exposed AWS credential files that leak access key ids and secret keys
  tags: [aws, credentials, secrets, exposure, recon]

type: http

http:
  method: GET
  paths:
    - "{{BaseURL}}/.aws/credentials"
    - "{{BaseURL}}/.s3cfg"
    - "{{BaseURL}}/.boto"

  threads: 3

  matchers:
    - type: status
      status:
        - 200

    - type: word
      part: body
      condition: or
      words:
        - "aws_secret_access_key"
        - "aws_access_key_id"
        - "secret_key"

    - type: word
      part: body
      negative: true
      condition: or
      words:
        - "<!DOCTYPE"
        - "<!doctype"
        - "<html"
        - "<HTML"
        - "<head>"
        - "<title>"

  extractors:
    - type: regex
      name: aws_access_key_id
      part: body
      regex:
        - '((?:AKIA|ASIA)[0-9A-Z]{16})'
      group: 1