Find exposed data in Azure with this public blob scanner
A tool for scanning Azure blob storage accounts for publicly opened blobs.
BlobHunter is a part of “Hunting Azure Blobs Exposes Millions of Sensitive Files” research:
BlobHunter helps you identify Azure blob storage containers which stored files that are publicly opened to everyone over the internet.
It can help you check for poorly configured containers storing sensitive data.
This can be helpful on large Azure subscriptions where there are lots of storage accounts that could be hard to track.
BlobHunter produces an informative csv result file with important details on each publicly opened container in the scanned environment.
- Python 3.5+
- Azure CLI
- Azure user with one of the following built-in roles:
- Storage Account ContributorOr any Azure user with a role that allows to perform the following Azure actions:
Microsoft.Resources/subscriptions/read Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Storage/storageAccounts/read Microsoft.Storage/storageAccounts/listkeys/action Microsoft.Storage/storageAccounts/blobServices/containers/read Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
Example for installation on Ubuntu:
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
pip3 install -r requirements.txt
If you are not logged in in the Azure CLI, a browser window will be prompted at you for inserting your Azure user credentials.
For any question or feedback, please contact DanielNiv, Asaf Hecht and CyberArk Labs. This project is not accepting contributions at this time.
Copyright (c) 2021 CyberArk Software Ltd. All rights reserved.
Licensed under the MIT License.
For the full license text see