translate

src/pentesting-cloud/gcp-security/README.md

@@ -247,4 +247,3 @@ gcloud config unset auth/access_token_file
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-basic-information/README.md

@@ -232,4 +232,3 @@ As defined by terraform in [https://registry.terraform.io/providers/hashicorp/go
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md

@@ -155,4 +155,3 @@ jobs:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md

@@ -146,4 +146,3 @@ roles/bigquery.metadataViewer
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/README.md

@@ -4,4 +4,3 @@
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md

@@ -23,4 +23,3 @@ Check how to do this in:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md

@@ -23,4 +23,3 @@ If yoi could just modify the code of a running version or create a new one yo co
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md

@@ -44,4 +44,3 @@ https://book.hacktricks.xyz/pentesting-web/dependency-confusion
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md

@@ -23,4 +23,3 @@ Grant further access over datasets, tables, rows and columns to compromised user
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md

@@ -21,4 +21,3 @@ For more info about Cloud Functions check:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md

@@ -27,4 +27,3 @@ Create a backdoored Service or Job
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md

@@ -71,4 +71,3 @@ But you can find further information in [https://github.com/FrancescoDiSalesGith
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md

@@ -39,4 +39,3 @@ For more information check the technique in:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md

@@ -21,4 +21,3 @@ For more informatoin about Compute and VPC (Networking) check:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md

@@ -55,4 +55,3 @@ gcloud dataflow $NAME_TEMPLATE run testing \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md

@@ -23,4 +23,3 @@ gcp-filestore-persistence.md
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md

@@ -23,4 +23,3 @@ gcloud logging sinks create <sink-name> <destination> --log-filter="FILTER_CONDI
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md

@@ -106,4 +106,3 @@ Some remediations for these techniques are explained in [https://www.netskope.co
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md

@@ -24,4 +24,3 @@ An attacker could update the secret to:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md

@@ -40,4 +40,3 @@ Another exploit script for this method can be found [here](https://github.com/Rh
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md

@@ -4,4 +4,3 @@
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md

@@ -45,4 +45,3 @@ Modify source code to steal credentials if they are being sent or perform a defa
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md

@@ -23,4 +23,3 @@ The Post Exploitation and Privesc techniques of Artifact Registry were mixed in:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md

@@ -31,4 +31,3 @@ curl -X POST \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md

@@ -55,7 +55,6 @@ def hello_http(request, last=False, error=""):
             return "Hello World!"
 
 
-
 # Attacker code to inject
 # Code based on the one from https://github.com/Djkusik/serverless_persistency_poc/blob/master/gcp/exploit_files/switcher.py
 
@@ -130,4 +129,3 @@ def injection():
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md

@@ -25,4 +25,3 @@ Modify the run image to steal information and redeploy the new version (just upl
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md

@@ -104,4 +104,3 @@ The instructions were copied from [https://github.com/FrancescoDiSalesGithub/Goo
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md

@@ -105,4 +105,3 @@ gcloud sql databases delete <db-name> --instance <instance-id>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md

@@ -122,4 +122,3 @@ If you **cannot give access to a external project** to the snapshot or disk, you
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md

@@ -102,4 +102,3 @@ gcloud filestore backups create <back-name> \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md

@@ -31,4 +31,3 @@ This is the **highest level you can assign using the gcloud tool**.
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md

@@ -259,4 +259,3 @@ print('Verified:', verified)
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md

@@ -135,4 +135,3 @@ gcloud logging sinks update SINK_NAME --no-use-partitioned-tables
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md

@@ -116,4 +116,3 @@ gcloud alpha monitoring channels update CHANNEL_ID --update-channel-labels=email
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md

@@ -142,4 +142,3 @@ gcloud pubsub subscriptions seek YOUR_SUBSCRIPTION_NAME \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md

@@ -24,4 +24,3 @@ gcloud secrets versions access 1 --secret="<secret_name>"
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md

@@ -60,4 +60,3 @@ gcloud scc findings update `myFinding` --organization=123456 --source=5678 --sta
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md

@@ -36,4 +36,3 @@ To access open buckets via browser, access the URL `https://<bucket_name>.storag
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md

@@ -23,4 +23,3 @@ The post exploitation techniques are actually the same ones as the ones shared i
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md

@@ -76,4 +76,3 @@ gcp-local-privilege-escalation-ssh-pivoting.md
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md

@@ -80,4 +80,3 @@ Check the following page to learn how to do this, although this action belongs t
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md

@@ -114,4 +114,3 @@ It might be possible that performing a **Race Condition attack like with the buc
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md

@@ -175,4 +175,3 @@ It might be possible that performing a **Race Condition attack like with the buc
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md

@@ -60,4 +60,3 @@ EOD
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md

@@ -118,4 +118,3 @@ bq query --nouse_legacy_sql 'DROP ALL ROW ACCESS POLICIES ON `<proj>.<dataset-na
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-clientauthconfig-privesc.md

@@ -28,4 +28,3 @@ gcloud iap oauth-clients create projects/PROJECT_NUMBER/brands/BRAND-ID --displa
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md

@@ -64,4 +64,3 @@ curl -X GET \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc.md

@@ -113,4 +113,3 @@ When a Cloud Function is created a new docker image is pushed to the Artifact Re
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudidentity-privesc.md

@@ -36,4 +36,3 @@ gcloud identity groups memberships modify-membership-roles --group-email <email>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md

@@ -119,4 +119,3 @@ gcloud auth activate-service-account --key-file=/tmp/lab.json
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md

@@ -127,4 +127,3 @@ TODO: Check what is possible to compromise by uploading data
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md

@@ -150,4 +150,3 @@ Following this link you find some [**ideas to try to bypass access scopes**](../
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md

@@ -102,4 +102,3 @@ It's possible to broaden the reach of SSH access to multiple Virtual Machines (V
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md

@@ -93,4 +93,3 @@ For more information [**follow this link**](../../kubernetes-security/abusing-ro
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md

@@ -31,4 +31,3 @@ This is like the previous abuse but instead of directly creating a new deploymen
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md

@@ -146,4 +146,3 @@ You can find an example on how to create and OpenID token behalf a service accou
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md

@@ -90,4 +90,3 @@ Replace `[YOUR_PROJECT_ID]` and `[SERVICE_ACCOUNT_EMAIL]` with your project ID a
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md

@@ -100,4 +100,3 @@ grep -Pzr '(?s)<form action.*?googleapis.com.*?name="signature" value=".*?">' \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md

@@ -27,4 +27,3 @@ This permission will usually let you **access or modify a Service Account in som
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md

@@ -58,4 +58,3 @@ This step authorizes the public key, enabling SSH connection with the correspond
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md

@@ -27,4 +27,3 @@ A python script for this method can be found [here](https://github.com/RhinoSecu
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md

@@ -39,4 +39,3 @@ Give yourself any of the preiovus permissions
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md

@@ -21,4 +21,3 @@ Like in the exploitation of `iam.serviceAccounts.setIamPolicy`, this permission
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md

@@ -91,4 +91,3 @@ gcloud beta run jobs execute job-name --region <region> --update-env-vars="PYTHO
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md

@@ -40,4 +40,3 @@ gcloud secrets add-iam-policy-binding <scret-name> \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md

@@ -59,4 +59,3 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md

@@ -89,4 +89,3 @@ gcloud source project-configs update --remove-topic=UPDATE_TOPIC
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md

@@ -119,4 +119,3 @@ The mentioned attack can be performed in a lot of different ways, all of them st
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md

@@ -109,4 +109,3 @@ With this permission instead of `workflows.workflows.create` it's possible to up
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/README.md

@@ -4,4 +4,3 @@
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md

@@ -24,4 +24,3 @@ gcloud ai-platform jobs describe <job>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md

@@ -46,4 +46,3 @@ gcloud services api-keys list --show-deleted
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md

@@ -119,4 +119,3 @@ gcloud app ssl-certificates describe <name>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md

@@ -94,4 +94,3 @@ gcloud artifacts docker images list-vulnerabilities projects/<proj-name>/locatio
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md

@@ -37,4 +37,3 @@ gcloud batch tasks describe projects/<proj-number>/locations/<location>/jobs/<jo
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md

@@ -231,4 +231,3 @@ SELECT catalog_name, schema_name, NULL FROM <project-name>.INFORMATION_SCHEMA.SC
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md

@@ -34,4 +34,3 @@ gcloud bigtable app-profiles describe --instance <INSTANCE> <app-prof>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md

@@ -173,4 +173,3 @@ done
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md

@@ -110,4 +110,3 @@ In the following page, you can check how to **abuse cloud function permissions t
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md

@@ -113,4 +113,3 @@ In the following page, you can check how to **abuse cloud run permissions to esc
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md

@@ -48,4 +48,3 @@ gcloud scheduler jobs describe --location us-central1 <scheduler-name>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md

@@ -30,4 +30,3 @@ Note that Cloud Shell can be **easily disabled** for the organization.
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md

@@ -91,4 +91,3 @@ gcloud sql backups describe <backup-name> --instance <intance-name>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md

@@ -45,4 +45,3 @@ In the following page you can check how to **abuse composer permissions to escal
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md

@@ -233,4 +233,3 @@ Check the Compute Instances privilege escalation section.
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md

@@ -105,4 +105,3 @@ A Google-managed encryption key is used by default a but a Customer-managed encr
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md

@@ -87,4 +87,3 @@ These are the needed permissions:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md

@@ -106,4 +106,3 @@ Even if the API **doesn't allow to modify resources**, it could be possible to f
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md

@@ -27,4 +27,3 @@ gcloud dns policies list
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md

@@ -76,4 +76,3 @@ There aren't ways to escalate privileges in GCP directly abusing this service, b
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md

@@ -79,4 +79,3 @@ You may be able to access some interesting information
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md

@@ -19,4 +19,3 @@ gcloud firestore export gs://my-source-project-export/export-20190113_2109 --col
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md

@@ -228,4 +228,3 @@ In the following page you can check how to **abuse org policies permissions to e
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md

@@ -84,4 +84,3 @@ gcloud kms decrypt --ciphertext-file=[INFILE] \
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md

@@ -148,4 +148,3 @@ There aren't logs of **`testIamPermissions`**:
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md

@@ -23,4 +23,3 @@ gcloud redis instances export gs://my-bucket/my-redis-instance.rdb my-redis-inst
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md

@@ -59,4 +59,3 @@ gcloud alpha monitoring channels describe <channel>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md

@@ -96,4 +96,3 @@ gcloud pubsub lite-operations describe <topic>
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md

@@ -55,4 +55,3 @@ An attacker could update the secret to **stop rotations** (so it won't be modifi
 
 
 
-

src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md

@@ -94,4 +94,3 @@ gcp-secrets-manager-enum.md
 
 
 
-