BuQuikker alternatives

Looking for an alternative tool to replace BuQuikker? During the review of BuQuikker we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. Bucket Finder (AWS S3 bucket finder)
  2. inSp3ctor (AWS S3 bucket and object discovery)
  3. S3Scanner (AWS S3 bucket scanner)

These tools are ranked as the best alternatives to BuQuikker.

Alternatives (by score)

74

Bucket Finder

Introduction

The Bucket Finder tool can be a helpful tool during penetration testing and security assessments. It helps with the discovery of S3 buckets on the Amazon AWS cloud.

Project details

Bucket Finder is written in Ruby.

Strengths and weaknesses

  • + The source code of this software is available
  • - No updates for a while

Typical usage

  • Data leak detection
  • Penetration testing
  • Security assessment

Bucket Finder review

56

inSp3ctor

Introduction

Like other S3 bucket scanners, inSp3ctor helps to find valid storage buckets on Amazon's AWS platform. This can be useful for security assignments like penetration testing or see what information is available about a company. Another option is using it to see if any private data is leaking.

Project details

inSp3ctor is written in Python.

Strengths and weaknesses

  • + The source code is easy to read and understand
  • + Very low number of dependencies
  • + The source code of this software is available
  • - No releases on GitHub available

Typical usage

  • Penetration testing
  • Security assessment
  • Storage security testing

inSp3ctor review

60

S3Scanner

Introduction

The aptly named S3Scanner is to be used to detect AWS S3 buckets. Discovered buckets are displayed, together with the related objects in the bucket.

Project details

S3Scanner is written in Python.

Strengths and weaknesses

  • + The source code of this software is available

    Typical usage

    • Information gathering
    • Information leak detection
    • Penetration testing
    • Storage security testing

    S3Scanner review

    64

    Teh S3 Bucketeers

    Introduction

    Tools like Teh S3 Bucketeers are valuable for doing reconnaissance and information gathering. They may be used during penetration tests and security assessments. The primary goal of these tools is to find S3 buckets that may lead to sensitive data stored on Amazon's storage service.

    Project details

    Teh S3 Bucketeers is written in shell script.

    Strengths and weaknesses

    • + The source code is easy to read and understand
    • + Used language is shell script
    • + The source code of this software is available
    • - No releases on GitHub available

    Typical usage

    • Penetration testing
    • Security assessment
    • Storage security testing

    Teh S3 Bucketeers review

    64

    AWSBucketDump

    Introduction

    AWSBucketDump is a security tool to find interesting files in AWS S3 buckets that are part of Amazon cloud services. These storage containers may have interesting files, which a tool like AWSBucketDump can discover.

    Project details

    AWSBucketDump is written in Python.

    Strengths and weaknesses

    • + More than 500 GitHub stars
    • + The source code of this software is available
    • - No releases on GitHub available

    Typical usage

    • Configuration audit
    • Discovery of sensitive information
    • Security assessment

    AWSBucketDump review

    60

    s3-fuzzer

    Introduction

    This fuzzing tool helps with discovering sensitive data in Amazon S3 buckets. S3 buckets are storage containers and may reveal data to unauthorized individuals. This tools helps with the discovery process.

    Project details

    s3-fuzzer is written in Golang.

    Strengths and weaknesses

    • + The source code of this software is available

      Typical usage

      • Configuration audit
      • Discovery of sensitive information
      • Security assessment

      s3-fuzzer review

      64

      Bucket Stream

      Introduction

      Bucket Stream can be used to discover AWS S3 buckets. This tool may be helpful during reconnaissance and security assessments. As it does not include active scanning on the target itself, it is a passive way of finding information. This is a huge benefit, as you don't have to guess or brute-force the names.

      Project details

      Bucket Stream is written in Python.

      Strengths and weaknesses

      • + Tool is easy to use
      • + The source code of this software is available
      • - No releases on GitHub available

      Typical usage

      • Discovery of sensitive information
      • Information leak detection
      • Penetration testing
      • Reconnaissance

      Bucket Stream review

      78

      CloudSploit scans

      Introduction

      CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

      Project details

      CloudSploit scans is written in Node.js.

      Strengths and weaknesses

      • + More than 10 contributors
      • + More than 500 GitHub stars
      • + The source code of this software is available
      • - No releases on GitHub available

      Typical usage

      • Configuration audit
      • IT audit
      • Security assessment

      CloudSploit scans review

      60

      Prowler

      Introduction

      Prowler is a security tool to check systems on AWS against the related CIS benchmark. This benchmark provides a set of best practices for AWS. The primary usage for this tool is system hardening and compliance checking.

      Project details

      Prowler is written in shell script.

      Strengths and weaknesses

      • + More than 25 contributors
      • + More than 500 GitHub stars
      • + The source code of this software is available

        Typical usage

        • Compliance testing
        • Security assessment
        • System hardening

        Prowler review

        60

        Security Monkey

        Introduction

        Security Monkey provides a single user interface to browse and search through all of your services and accounts.

        Project details

        Security Monkey is written in Python.

        Strengths and weaknesses

        • + More than 50 contributors
        • + More than 1000 GitHub stars
        • + The source code of this software is available
        • + Supported by a large company

          Typical usage

          • Security monitoring

          Security Monkey review

          64

          Zeus

          Introduction

          Zeus is a tool to perform a quick security scan of an AWS environment. It helps to find missing security controls, so additional system hardening measures can be applied to systems.

          Project details

          Zeus is written in shell script.

          Strengths and weaknesses

          • + Used language is shell script
          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Configuration audit
          • Security assessment
          • Self-assessment
          • System hardening

          Zeus review

          81

          Confidant

          Introduction

          Most applications with a connection to a database or other software component, need some form of authentication. Often the related credentials are stored in a configuration file. A secret manager like Confidant will provide an alternative, by storing the details in a database. Only applications that need to access the secrets are allowed to obtain them. Often system administrators are denied access to them.

          Project details

          Confidant is written in Python.

          Strengths and weaknesses

          • + More than 1000 GitHub stars
          • + The source code of this software is available
          • + Supported by a large company

            Typical usage

            • Secrets management
            • Secure storage

            Confidant review

            93

            Acra

            Introduction

            Acra is a database encryption proxy that provides encryption and data leakage prevention to applications. It provides selective encryption, access control, database and data leak prevention, and even intrusion detection capabilities. It is focused on developers and supports most popular programming languages such as Go, PHP, Python, Ruby.

            Project details

            Acra is written in Golang, Node.js, Objective-C, PHP, Python, Ruby.

            Strengths and weaknesses

            • + Commercial support available
            • + The source code of this software is available

              Typical usage

              • Data encryption
              • Data leak prevention
              • Data security
              • Vulnerability mitigation

              Acra review

              85

              AIL framework

              Introduction

              AIL is a modular framework which helps to analyze potential information leaks. The framework is flexible and supports different kinds of data formats and sources. For example, one of the sources is the collection of pastes from Pastebin. A tool like AIL is commonly used to detect or even prevent data leaks.

              Project details

              AIL framework is written in Python.

              Strengths and weaknesses

              • + More than 10 contributors
              • + The source code of this software is available

                Typical usage

                • Data extraction
                • Data leak detection
                • Information leak detection
                • Security monitoring

                AIL framework review

                64

                DNSteal

                Introduction

                DNSteal allows you to extract files from a machine through DNS requests. This can be used to circumvent security measures and test them against data leakage. The tool supports compression and allows for multiple files to be transferred.

                Project details

                DNSteal is written in Python.

                Strengths and weaknesses

                • + More than 500 GitHub stars
                • + The source code of this software is available
                • - No releases on GitHub available
                • - Full name of author is unknown

                Typical usage

                • Application security
                • Data hiding

                DNSteal review

                85

                gitleaks

                Introduction

                Gitleaks scans the repository, including history, for secrets and other sensitive data. This can be useful for both developers as security professionals to discover any leaks.

                Project details

                gitleaks is written in Golang.

                Strengths and weaknesses

                • + More than 10 contributors
                • + More than 3000 GitHub stars
                • + The source code of this software is available

                  Typical usage

                  • Security assessment

                  gitleaks review

                  60

                  GitMiner

                  Introduction

                  GitMiner is a tool to scan for sensitive data that is leaked via software repositories. Examples of sensitive data are authentication details such as passwords or connection settings.

                  Project details

                  GitMiner is written in Python.

                  Strengths and weaknesses

                  • + More than 1000 GitHub stars
                  • + The source code of this software is available

                    Typical usage

                    • Asset discovery
                    • Discovery of sensitive information
                    • Information leak detection

                    GitMiner review

                    68

                    git-secrets

                    Introduction

                    You would most likely use git-secrets in development teams or as an individual developer. The primary goal is to prevent accidentally submitting authentication details or otherwise sensitive information to your software repositories.

                    Project details

                    git-secrets is written in shell script.

                    Strengths and weaknesses

                    • + The source code of this software is available

                      Typical usage

                      • Data leak prevention
                      • Information leak prevention

                      git-secrets review

                      85

                      SMBMap

                      Introduction

                      SMBMap allows scanning of file resources that are shared with the SMB protocol. The tool will list share drives, drive permissions, the share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. The tool was created for pentesters to simplify finding sensitive data, or at least test for it.

                      Project details

                      SMBMap is written in Python.

                      Strengths and weaknesses

                      • + The source code of this software is available

                        Typical usage

                        • Data leak detection
                        • Information gathering
                        • Penetration testing

                        SMBMap review

                        64

                        nfsshell

                        Introduction

                        Tools like this are typically used to manually check security problems with NFS. It can provide more details about an NFS server and the resources it has available.

                        Project details

                        nfsshell is written in C.

                        Strengths and weaknesses

                        • + The source code of this software is available

                          Typical usage

                          • Application security
                          • Storage security testing

                          nfsshell review

                          96

                          Samba

                          Introduction

                          Since 1992, Samba provides file and print services based on the server message block (SMB) protocol. This protocol was released by Microsoft as part of the open specifications.

                          Samba helps with interoperability between systems running Microsoft Windows and those running one of the flavor of Unix like Linux. The toolkit allows systems to become part of the Active Directory environment and join a domain controller or domain member.

                          Project details

                          Strengths and weaknesses

                          • + The source code of this software is available

                            Samba review

                            Some relevant tool missing as an alternative to BuQuikker? Please contact us with your suggestion.