# GCP - Storage Unauthenticated Enum

{{#include ../../../../banners/hacktricks-training.md}}

## Storage

Za više informacija o Storage, proverite:

{{#ref}}
../../gcp-services/gcp-storage-enum.md
{{#endref}}

### Public Bucket Brute Force

**Format URL-a** za pristup bucket-u je **`https://storage.googleapis.com/<bucket-name>`.**

Sledeći alati se mogu koristiti za generisanje varijacija imena i pretragu za pogrešno konfigurisanim bucket-ima sa tim imenima:

- [https://github.com/RhinoSecurityLabs/GCPBucketBrute](https://github.com/RhinoSecurityLabs/GCPBucketBrute)

**Takođe alati** pomenuti u:

{{#ref}}
../
{{#endref}}

Ako otkrijete da možete **pristupiti bucket-u**, možda ćete moći da **escalate još dalje**, proverite:

{{#ref}}
gcp-public-buckets-privilege-escalation.md
{{#endref}}

### Search Open Buckets in Current Account

Sa sledećim skriptom [prikupljenim odavde](https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/gcp_misc/-/blob/master/find_open_buckets.sh) možete pronaći sve otvorene bucket-e:
```bash
#!/bin/bash

############################
# Run this tool to find buckets that are open to the public anywhere
# in your GCP organization.
#
# Enjoy!
############################

for proj in $(gcloud projects list --format="get(projectId)"); do
echo "[*] scraping project $proj"
for bucket in $(gsutil ls -p $proj); do
echo "    $bucket"
ACL="$(gsutil iam get $bucket)"

all_users="$(echo $ACL | grep allUsers)"
all_auth="$(echo $ACL | grep allAuthenticatedUsers)"

if [ -z "$all_users" ]
then
:
else
echo "[!] Open to all users: $bucket"
fi

if [ -z "$all_auth" ]
then
:
else
echo "[!] Open to all authenticated users: $bucket"
fi
done
done
```
{{#include ../../../../banners/hacktricks-training.md}}
