1、Blob配置错误-公开访问
在创建存储账户时,默认是启用Blob公共访问的,当创建容器的访问级别配置为容器(匿名读取访问容器和blob)时,就会导致匿名请求枚举容器中的 blob
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288187-713687-1.png)
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288194-996215-2.png)
当配置访问级别为专用或禁用Blob公共访问时,提示ResourceNotFound
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288203-378634-3.png)
当配置访问级别为Blob(仅匿名读取访问blob)时,可以读取容器中的blob,但是不可以枚举
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288216-274757-4.png)
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288244-749141-5.png)
2、使用DNS枚举
每个资源终结点都是<存储帐户>.blob.core.windows.net
存在时,可以解析
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288257-946790-6.png)
不存在时,无法解析
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288263-185732-7.png)
使用Dns 枚举进行发现
python dnscan.py -d blob.core.windows.net -w subdomains-100.txt
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288269-589655-8.png)
3、Bucket Object 遍历
当创建容器的访问级别配置为容器(匿名读取访问容器和blob)时,就会导致匿名请求枚举容器中的 blob
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288274-431247-9.png)
4、account keys泄漏
- Github代码中泄露
- 网站JS代码
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288286-709065-10.png)
5、子域名接管
创建好Blob后自定义域,即可以通过自定义域去访问资源
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288292-715048-11.png)
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288309-683145-12.png)
当删除该存储账户后访问
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288317-788338-13.png)
再次创建相同的存储账户去接管子域名
![](https://huoxian-community.oss-cn-beijing.aliyuncs.com/2022-03-03/1646288321-449109-14.png)
六大云存储攻击文章:
阿里云 OSS对象存储攻防(UzJu):https://zone.huoxian.cn/d/918-oss
Aws S3 对象存储攻防(TeamsSix):https://zone.huoxian.cn/d/907-aws-s3
谷歌云 对象存储攻防(ricky):https://zone.huoxian.cn/d/931