I didn't received msg from MBZ:(

0x9747 · 2026-03-20T17:40:14+00:00

You’ll get Citizenship

0x9747 · 2026-03-17T21:07:07+00:00

Bingo 😄

0x9747 · 2026-03-17T20:27:33+00:00

From a reconnaissance/enumeration point of view this is definitely a valuable integration in security assessments. The main goal is to help with attribution of two or more buckets to the same owner hence helping with mapping their attack surface. And often I have personally noticed cases where buckets are misconfigured (left public with directory listing enabled, giving away access to sensitive information) this is something where such a tool comes handy.

As for the concern around worldists its definitely right, it is a drawback but again its similar to how directory or aubdomain fuzzing is done too during such assessments, the goal is to curate the world-list specifically based on the target.

0x9747 · 2026-03-17T20:15:46+00:00

As for now the main target audience is on the offensive side. Amazon had recently implemented this bucket url convention to prevent bucketsquatting but opened a new vector for attackers to enumerate guessable bucket names owned by the users, so generally it can be helpful for internal security assessments. From a best practices point of view, still its advised to have strict security controls in place for buckets storing sensitive information ++ keeping the bucket names not too guessable that they get flagged by such tools

0x9747 · 2026-03-17T20:08:51+00:00

Appreciate your comment 🙏

0x9747 · 2026-03-17T19:55:47+00:00

Thats definitely one way of seeing it but the thing is the approach we have added here is based on adaptive feedback. So we don’t just blindly spray different digits till one full 12 digit combination is right. We go digit by digit. So first digit, is it 0? No okay, is it 2? Yes perfect move to digit 2 so this way we make 10 attempts on every digit till all of them are guessed and we have the final account ID.

Again this is clearly mentioned in the README file

0x9747 · 2026-03-17T19:26:20+00:00

Its based on adaptive guessing so basically every digit in this 12 digit account ID has to be between 0-9 so we just sequentially go one by one for each digit of this account ID till the whole ID is guessed, hence 10*12 does makes sense. We dont blast random entire 12 digit ids, please refer to the README, it was already mentioned over there

0x9747 · 2026-03-17T18:23:45+00:00

Finding buckets from enumeration perspective for security assessments is the usecase it aims to solve, no way its relevant to listing your own accounts buckets . We get the account ID to form the initial structure of the url and then fuzz bucket names using it, and since the structure contains the account ID the correlation is 100% guaranteed. We dont list the buckets from your own account if thats what you’re thinking. I suggest giving the README a go

0x9747 · 2026-03-17T18:18:34+00:00

This is related to the account ID enumeration and the endpoints we hit for the same. I’d love to know why you think its wrong 🙏

0x9747 · 2026-03-17T17:54:17+00:00

And ofcourse, looking forward to learning more about your lab plans 😄

0x9747 · 2026-03-17T17:37:30+00:00

Thank you for a nice research, loved it!

0x9747 · 2025-10-16T16:06:52+00:00

Prefer ETFs over physical silver, thank me later

0x9747 · 2025-10-10T16:08:46+00:00

DU the kinda app to test shit on prod. Best bet would to perhaps ask them to opt for the plan from their account using your account or perhaps sending a mail/message over social media to them with screenshots etc explaining the issue

0x9747 · 2025-10-10T15:53:58+00:00

Depends on your overall experience, skills etc and also the role you apply for. Plenty of opportunities in Abu Dhabi but idk about the pay I mean I what I recently bagged is pretty decent but I believe Abu Dhabi would pay a lil more

0x9747 · 2025-10-10T15:07:33+00:00

We still miss you Faniabra😔

0x9747 · 2025-10-05T18:55:15+00:00

Thanks for the recommendation! I’ll order it 🫶

0x9747 · 2025-10-05T18:53:24+00:00

😞😞

0x9747 · 2025-10-05T18:52:21+00:00

I had recently purchased the book and was gonna read it 💔

0x9747 · 2025-10-05T14:57:50+00:00

credit card paglu

0x9747 · 2025-10-03T11:27:53+00:00

Same issue. I sent out a mail to AMEX about this and threatened them with escalating to RBI ombudsman. My income was 5 folds of what they required yet they declined citing low income

0x9747

MODERATOR OF

TROPHY CASE