cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/aws/lambda_enum.py

@@ -0,0 +1,85 @@
+"""AWS Lambda enumeration — list functions, runtimes, env vars, layers."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.lambda_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["aws_api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1526"],
+}
+
+
+def run(args: Any) -> int:
+    print(f"[*] AWS Lambda Enumeration (region: {args.region})")
+
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr)
+        return 1
+
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    lam = session.client("lambda")
+
+    try:
+        paginator = lam.get_paginator("list_functions")
+        functions = []
+        for page in paginator.paginate():
+            functions.extend(page["Functions"])
+    except Exception as exc:
+        print(f"[-] list_functions failed: {exc}", file=sys.stderr)
+        return 1
+
+    print(f"[+] {len(functions)} Lambda functions")
+    results = []
+
+    for fn in functions:
+        entry = {
+            "name": fn["FunctionName"],
+            "runtime": fn.get("Runtime", "container"),
+            "role": fn["Role"],
+            "handler": fn.get("Handler"),
+            "code_size": fn["CodeSize"],
+            "timeout": fn.get("Timeout"),
+            "memory": fn.get("MemorySize"),
+            "last_modified": fn.get("LastModified"),
+            "layers": [l["Arn"] for l in fn.get("Layers", [])],
+        }
+
+        env_vars = fn.get("Environment", {}).get("Variables", {})
+        if env_vars:
+            sensitive_keys = [k for k in env_vars if any(
+                s in k.upper() for s in ["SECRET", "KEY", "TOKEN", "PASSWORD", "CREDENTIAL", "API_KEY"]
+            )]
+            entry["env_var_count"] = len(env_vars)
+            entry["sensitive_env_keys"] = sensitive_keys
+            if sensitive_keys:
+                print(f"  [!] {fn['FunctionName']}: sensitive env vars: {', '.join(sensitive_keys)}")
+
+        vpc = fn.get("VpcConfig", {})
+        if vpc.get("SubnetIds"):
+            entry["vpc"] = True
+            entry["subnets"] = vpc["SubnetIds"]
+        else:
+            entry["vpc"] = False
+
+        results.append(entry)
+
+    os.makedirs(args.output, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_path = os.path.join(args.output, f"aws_lambda_{ts}.json")
+    with open(out_path, "w") as fh:
+        json.dump(results, fh, indent=2, default=str)
+
+    print(f"[+] Output: {out_path}")
+    return 0

cloudxpl/modules/aws/lambda_inject.py

@@ -0,0 +1,79 @@
+"""AWS Lambda event injection — trigger abuse, environment extraction, layer analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.lambda_inject.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1648"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Lambda Injection Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    lam = session.client("lambda")
+    results = {"functions": [], "injectable": []}
+    try:
+        paginator = lam.get_paginator("list_functions")
+        for page in paginator.paginate():
+            for fn in page["Functions"]:
+                fname = fn["FunctionName"]
+                info = {"name": fname, "runtime": fn.get("Runtime", "unknown"), "role": fn["Role"], "handler": fn.get("Handler", "")}
+                env_vars = fn.get("Environment", {}).get("Variables", {})
+                if env_vars:
+                    info["env_var_count"] = len(env_vars)
+                    sensitive_keys = [k for k in env_vars if any(s in k.upper() for s in ["KEY", "SECRET", "TOKEN", "PASSWORD", "API"])]
+                    if sensitive_keys:
+                        info["sensitive_env_keys"] = sensitive_keys
+                        print(f"  [!] {fname}: sensitive env vars: {sensitive_keys}")
+                layers = fn.get("Layers", [])
+                if layers:
+                    info["layers"] = [l["Arn"] for l in layers]
+                try:
+                    policy = lam.get_policy(FunctionName=fname)
+                    import json as _json
+                    pol = _json.loads(policy["Policy"])
+                    for stmt in pol.get("Statement", []):
+                        if stmt.get("Principal") in ("*", {"AWS": "*"}):
+                            info["public_invoke"] = True
+                            results["injectable"].append({"function": fname, "type": "public_invoke"})
+                            print(f"  [!] {fname}: publicly invokable!")
+                except Exception: pass
+                try:
+                    mappings = lam.list_event_source_mappings(FunctionName=fname)["EventSourceMappings"]
+                    if mappings:
+                        info["event_sources"] = [{"source": m["EventSourceArn"], "state": m["State"]} for m in mappings]
+                except Exception: pass
+                results["functions"].append(info)
+    except Exception as exc:
+        print(f"[-] Lambda enum failed: {exc}"); return 1
+    _save(args, "aws_lambda_inject", results)
+    print(f"[+] {len(results['functions'])} functions, {len(results['injectable'])} injectable")
+    return 0

cloudxpl/modules/aws/lambda_persist.py

@@ -0,0 +1,69 @@
+"""AWS Lambda persistence — layer poisoning analysis, trigger backdoor assessment."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.lambda_persist.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1525","T1098"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Lambda Persistence Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    lam = session.client("lambda")
+    results = {"layers": [], "persistence_vectors": []}
+    try:
+        paginator = lam.get_paginator("list_layers")
+        for page in paginator.paginate():
+            for layer in page["Layers"]:
+                info = {"name": layer["LayerName"], "arn": layer["LayerArn"], "latest_version": layer["LatestMatchingVersion"]["Version"]}
+                results["layers"].append(info)
+                print(f"  [*] Layer: {layer['LayerName']} (v{info['latest_version']})")
+    except Exception as exc:
+        print(f"[-] Layer enum failed: {exc}")
+    try:
+        for page in lam.get_paginator("list_functions").paginate():
+            for fn in page["Functions"]:
+                fname = fn["FunctionName"]
+                role = fn["Role"]
+                if fn.get("Layers"):
+                    results["persistence_vectors"].append({"function": fname, "type": "layer_attached", "layers": [l["Arn"] for l in fn["Layers"]], "role": role})
+                url_config = None
+                try:
+                    url_config = lam.get_function_url_config(FunctionName=fname)
+                    if url_config.get("AuthType") == "NONE":
+                        results["persistence_vectors"].append({"function": fname, "type": "public_url", "url": url_config["FunctionUrl"]})
+                        print(f"  [!] {fname}: public function URL (no auth)")
+                except Exception: pass
+    except Exception: pass
+    _save(args, "aws_lambda_persist", results)
+    print(f"[+] {len(results['layers'])} layers, {len(results['persistence_vectors'])} persistence vectors")
+    return 0

cloudxpl/modules/aws/org_enum.py

@@ -0,0 +1,58 @@
+"""AWS Organizations enumeration — accounts, OUs, SCPs."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.org_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1526"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Organizations Enumeration")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    org = session.client("organizations")
+    results = {"organization": {}, "accounts": [], "roots": []}
+    try:
+        org_info = org.describe_organization()["Organization"]
+        results["organization"] = {"id": org_info["Id"], "master_account": org_info["MasterAccountId"], "master_email": org_info.get("MasterAccountEmail", "")}
+        print(f"[+] Org: {org_info['Id']} (master: {org_info['MasterAccountId']})")
+    except Exception as exc:
+        print(f"[-] Not an org member or insufficient permissions: {exc}"); return 1
+    try:
+        paginator = org.get_paginator("list_accounts")
+        for page in paginator.paginate():
+            for acct in page["Accounts"]:
+                results["accounts"].append({"id": acct["Id"], "name": acct["Name"], "email": acct.get("Email", ""), "status": acct["Status"]})
+                print(f"  [+] {acct['Id']}: {acct['Name']} ({acct['Status']})")
+    except Exception: pass
+    _save(args, "aws_org_enum", results)
+    print(f"[+] {len(results['accounts'])} accounts found")
+    return 0

cloudxpl/modules/aws/pacu_bridge.py

@@ -0,0 +1,45 @@
+"""Bridge para Pacu AWS exploitation framework — execute and import results."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.pacu_bridge.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['api_calls'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078","T1068"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print("[*] Pacu Framework Bridge")
+    import shutil
+    import subprocess
+    pacu_path = shutil.which("pacu")
+    if not pacu_path:
+        print("[!] Pacu not found in PATH. Install: pip install pacu"); return 1
+    print(f"[+] Pacu found: {pacu_path}")
+    results = {"pacu_path": pacu_path, "available": True, "note": "Use pacu interactively for exploitation. This bridge verifies availability."}
+    _save(args, "aws_pacu_bridge", results)
+    print("[+] Pacu bridge ready — launch with: pacu")
+    return 0

cloudxpl/modules/aws/rds_enum.py

@@ -0,0 +1,64 @@
+"""AWS RDS enumeration — instances, clusters, public snapshots."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.rds_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1526"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS RDS Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    rds = session.client("rds")
+    results = {"instances": [], "public": [], "snapshots": []}
+    try:
+        paginator = rds.get_paginator("describe_db_instances")
+        for page in paginator.paginate():
+            for db in page["DBInstances"]:
+                info = {"id": db["DBInstanceIdentifier"], "engine": db["Engine"], "status": db["DBInstanceStatus"], "public": db.get("PubliclyAccessible", False), "encrypted": db.get("StorageEncrypted", False)}
+                if info["public"]:
+                    results["public"].append(db["DBInstanceIdentifier"])
+                    print(f"  [!] {db['DBInstanceIdentifier']}: PUBLICLY accessible ({db['Engine']})")
+                else:
+                    print(f"  [+] {db['DBInstanceIdentifier']}: {db['Engine']} ({db['DBInstanceStatus']})")
+                results["instances"].append(info)
+    except Exception as exc:
+        print(f"[-] RDS enum failed: {exc}"); return 1
+    try:
+        snaps = rds.describe_db_snapshots(SnapshotType="public")
+        for snap in snaps.get("DBSnapshots", []):
+            results["snapshots"].append({"id": snap["DBSnapshotIdentifier"], "engine": snap["Engine"]})
+            print(f"  [!] Public snapshot: {snap['DBSnapshotIdentifier']}")
+    except Exception: pass
+    _save(args, "aws_rds_enum", results)
+    print(f"[+] {len(results['instances'])} instances, {len(results['public'])} public")
+    return 0

cloudxpl/modules/aws/rds_exploit.py

@@ -0,0 +1,57 @@
+"""AWS RDS exploitation — snapshot sharing, password reset vectors."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.rds_exploit.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS RDS Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    rds = session.client("rds")
+    results = {"exploit_vectors": []}
+    try:
+        snaps = rds.describe_db_snapshots(SnapshotType="manual")
+        for snap in snaps.get("DBSnapshots", []):
+            try:
+                attrs = rds.describe_db_snapshot_attributes(DBSnapshotIdentifier=snap["DBSnapshotIdentifier"])
+                for attr in attrs.get("DBSnapshotAttributesResult", {}).get("DBSnapshotAttributes", []):
+                    if attr.get("AttributeName") == "restore" and "all" in attr.get("AttributeValues", []):
+                        results["exploit_vectors"].append({"type": "public_snapshot", "snapshot": snap["DBSnapshotIdentifier"]})
+                        print(f"  [!] {snap['DBSnapshotIdentifier']}: publicly restorable")
+            except Exception: pass
+    except Exception as exc:
+        print(f"[-] Snapshot analysis failed: {exc}"); return 1
+    _save(args, "aws_rds_exploit", results)
+    print(f"[+] {len(results['exploit_vectors'])} exploit vectors found")
+    return 0

cloudxpl/modules/aws/route53_takeover.py

@@ -0,0 +1,63 @@
+"""AWS Route53 subdomain takeover — dangling CNAME, alias records, NS delegation."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.route53_takeover.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1584.001"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Route53 Subdomain Takeover Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    r53 = session.client("route53")
+    results = {"zones": [], "dangling": []}
+    try:
+        zones = r53.list_hosted_zones()["HostedZones"]
+        for zone in zones:
+            zid = zone["Id"].split("/")[-1]
+            info = {"id": zid, "name": zone["Name"], "private": zone["Config"].get("PrivateZone", False), "records": []}
+            paginator = r53.get_paginator("list_resource_record_sets")
+            for page in paginator.paginate(HostedZoneId=zid):
+                for rr in page["ResourceRecordSets"]:
+                    if rr["Type"] == "CNAME":
+                        target = rr.get("ResourceRecords", [{}])[0].get("Value", "") if rr.get("ResourceRecords") else ""
+                        info["records"].append({"name": rr["Name"], "type": "CNAME", "target": target})
+                        takeover_sigs = [".s3.amazonaws.com", ".cloudfront.net", ".elasticbeanstalk.com", ".herokuapp.com", ".azurewebsites.net", ".trafficmanager.net"]
+                        if any(sig in target for sig in takeover_sigs):
+                            results["dangling"].append({"record": rr["Name"], "target": target, "zone": zone["Name"]})
+                            print(f"  [!] Potential takeover: {rr['Name']} -> {target}")
+            results["zones"].append(info)
+    except Exception as exc:
+        print(f"[-] Route53 enum failed: {exc}"); return 1
+    _save(args, "aws_route53_takeover", results)
+    print(f"[+] {len(results['zones'])} zones, {len(results['dangling'])} potential takeovers")
+    return 0

cloudxpl/modules/aws/s3_enum.py

@@ -0,0 +1,96 @@
+"""AWS S3 bucket enumeration — list buckets, check ACLs, detect public access."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.s3_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["aws_api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def run(args: Any) -> int:
+    print(f"[*] AWS S3 Bucket Enumeration (region: {args.region})")
+
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr)
+        return 1
+
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    s3 = session.client("s3")
+
+    try:
+        buckets = s3.list_buckets()["Buckets"]
+    except Exception as exc:
+        print(f"[-] list_buckets failed: {exc}", file=sys.stderr)
+        return 1
+
+    print(f"[+] {len(buckets)} buckets found")
+    results = []
+
+    for bucket in buckets:
+        name = bucket["BucketName"]
+        entry: dict[str, Any] = {"name": name, "created": bucket["CreationDate"].isoformat()}
+
+        try:
+            acl = s3.get_bucket_acl(Bucket=name)
+            public_grants = [
+                g for g in acl.get("Grants", [])
+                if g.get("Grantee", {}).get("URI", "").endswith("AllUsers")
+                or g.get("Grantee", {}).get("URI", "").endswith("AuthenticatedUsers")
+            ]
+            entry["public_acl"] = bool(public_grants)
+            if public_grants:
+                entry["public_grants"] = [g["Permission"] for g in public_grants]
+                print(f"  [!] {name}: PUBLIC ACL — {', '.join(entry['public_grants'])}")
+        except Exception:
+            entry["acl_error"] = "AccessDenied"
+
+        try:
+            pab = s3.get_public_access_block(Bucket=name)["PublicAccessBlockConfiguration"]
+            entry["public_access_block"] = pab
+            all_blocked = all(pab.values())
+            if not all_blocked:
+                print(f"  [!] {name}: Public access block INCOMPLETE")
+        except s3.exceptions.NoSuchPublicAccessBlockConfiguration:
+            entry["public_access_block"] = None
+            print(f"  [!] {name}: NO public access block configured")
+        except Exception:
+            pass
+
+        try:
+            enc = s3.get_bucket_encryption(Bucket=name)
+            rules = enc["ServerSideEncryptionConfiguration"]["Rules"]
+            entry["encryption"] = rules[0]["ApplyServerSideEncryptionByDefault"]["SSEAlgorithm"]
+        except Exception:
+            entry["encryption"] = None
+
+        try:
+            versioning = s3.get_bucket_versioning(Bucket=name)
+            entry["versioning"] = versioning.get("Status", "Disabled")
+        except Exception:
+            pass
+
+        results.append(entry)
+
+    os.makedirs(args.output, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_path = os.path.join(args.output, f"aws_s3_{ts}.json")
+    with open(out_path, "w") as fh:
+        json.dump(results, fh, indent=2, default=str)
+
+    public_count = sum(1 for r in results if r.get("public_acl"))
+    print(f"[+] {public_count} public buckets, {len(results)} total → {out_path}")
+    return 0