AWS S3 DUMP 50+ exposed AWS S3 buckets with config files containing payment gateway API keys, Stripe tokens, and SMTP creds.
What We Found:- Stripe secret keys (live) — 12 buckets
- PayPal API credentials — 8 buckets
- SMTP credentials — 22 buckets
- AWS Access Keys (full access) — 6 buckets
- Database connection strings — 15 buckets
- .env files with all of the above — countless
How Were They Found:
Code:
1. Use bucket finder tools (Mass3, S3Scanner, BucketStream)
2. Scan domain list: {company}-backup, {company}-config, {company}-env
3. Check common patterns: dev., staging., backup., config., internal.
4. Download all files
5. Grep for API keys, tokens, passwords
6. Test against live endpoints
Dataset Price: $150- Bucket names + regions
- All downloaded files
- Extracted credentials (sorted by type)
- Suggested usage for each credential type
These buckets were open as of 72 hours ago. Some may have been closed after detection.