translate 2

src/pentesting-ci-cd/apache-airflow-security/README.md

@@ -177,4 +177,3 @@ If they are used for example inside a a bash command, you could perform a comman
 
 
 
-

src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md

@@ -113,4 +113,3 @@ AUTH_ROLE_PUBLIC = 'Admin'
 
 
 
-

src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md

@@ -45,4 +45,3 @@ These are the default permissions per default role:
 
 
 
-

src/pentesting-ci-cd/atlantis-security.md

@@ -390,4 +390,3 @@ You can also pass these as environment variables `ATLANTIS_WEB_BASIC_AUTH=true`
 
 
 
-

src/pentesting-ci-cd/circleci-security.md

@@ -257,4 +257,3 @@ jobs:
 
 
 
-

src/pentesting-ci-cd/cloudflare-security/README.md

@@ -136,4 +136,3 @@ cloudflare-zero-trust-network.md
 
 
 
-

src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md

@@ -135,4 +135,3 @@ TODO
 
 
 
-

src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md

@@ -63,4 +63,3 @@ TODO
 
 
 
-

src/pentesting-ci-cd/concourse-security/README.md

@@ -35,4 +35,3 @@ concourse-enumeration-and-attacks.md
 
 
 
-

src/pentesting-ci-cd/concourse-security/concourse-architecture.md

@@ -40,4 +40,3 @@ In order to execute tasks concourse must have some workers. These workers **regi
 
 
 
-

src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md

@@ -444,4 +444,3 @@ Accept-Encoding: gzip.
 
 
 
-

src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md

@@ -153,4 +153,3 @@ Check a YAML pipeline example that triggers on new commits to master in [https:/
 
 
 
-

src/pentesting-ci-cd/gitea-security/README.md

@@ -140,4 +140,3 @@ If you are inside the server you can also **use the `gitea` binary** to access/m
 
 
 
-

src/pentesting-ci-cd/gitea-security/basic-gitea-information.md

@@ -105,4 +105,3 @@ Different protections can be applied to a branch (like to master):
 
 
 
-

src/pentesting-ci-cd/github-security/README.md

@@ -246,4 +246,3 @@ For more info check [https://www.chainguard.dev/unchained/what-the-fork-imposter
 
 
 
-

src/pentesting-ci-cd/github-security/abusing-github-actions/README.md

@@ -583,4 +583,3 @@ The following tools are useful to find Github Action workflows and even find vul
 
 
 
-

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md

@@ -4,4 +4,3 @@
 
 
 
-

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md

@@ -4,4 +4,3 @@
 
 
 
-

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md

@@ -4,4 +4,3 @@
 
 
 
-

src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md

@@ -58,4 +58,3 @@ And the latest one use a short sha-1 that is bruteforceable.
 
 
 
-

src/pentesting-ci-cd/github-security/basic-github-information.md

@@ -257,4 +257,3 @@ Different protections can be applied to a branch (like to master):
 
 
 
-

src/pentesting-ci-cd/jenkins-security/README.md

@@ -414,4 +414,3 @@ println(hudson.util.Secret.decrypt("{...}"))
 
 
 
-

src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md

@@ -96,4 +96,3 @@ According to [**the docs**](https://www.jenkins.io/blog/2019/02/21/credentials-m
 
 
 
-

src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md

@@ -107,4 +107,3 @@ The example curl command provided demonstrates how to make a request to Jenkins
 
 
 
-

src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md

@@ -91,4 +91,3 @@ for (c in creds) {
 
 
 
-

src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md

@@ -41,4 +41,3 @@ If you can access the configuration file of some pipeline configured you could j
 
 
 
-

src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md

@@ -38,4 +38,3 @@ If you are not executing a reverse shell but a simple command you can **see the
 
 
 
-

src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md

@@ -65,4 +65,3 @@ msf> use exploit/multi/http/jenkins_script_console
 
 
 
-

src/pentesting-ci-cd/okta-security/README.md

@@ -116,4 +116,3 @@ okta-hardening.md
 
 
 
-

src/pentesting-ci-cd/okta-security/okta-hardening.md

@@ -201,4 +201,3 @@ Here you can download Okta agents to sync Okta with other technologies.
 
 
 
-

src/pentesting-ci-cd/pentesting-ci-cd-methodology.md

@@ -106,4 +106,3 @@ Check this interesting article about the top 10 CI/CD risks according to Cider:
 
 
 
-

src/pentesting-ci-cd/serverless.com-security.md

@@ -860,4 +860,3 @@ Granting excessive permissions to team members and external collaborators can le
 
 
 
-

src/pentesting-ci-cd/supabase-security.md

@@ -165,4 +165,3 @@ It's possible to **store secrets** in supabase also which will be **accessible b
 
 
 
-

src/pentesting-ci-cd/terraform-security.md

@@ -314,4 +314,3 @@ brew install terrascan
 
 
 
-

src/pentesting-ci-cd/todo.md

@@ -18,4 +18,3 @@ Github PRs are welcome explaining how to (ab)use those platforms from an attacke
 
 
 
-

src/pentesting-ci-cd/travisci-security/README.md

@@ -67,4 +67,3 @@ If an attacker ends in an environment which uses **TravisCI enterprise** (more i
 
 
 
-

src/pentesting-ci-cd/travisci-security/basic-travisci-information.md

@@ -94,4 +94,3 @@ The amount of deployed TCI Worker and build environment OS images will determine
 
 
 
-

src/pentesting-ci-cd/vercel-security.md

@@ -439,4 +439,3 @@ An **Access Group** in Vercel is a collection of projects and team members with
 
 
 
-

src/pentesting-cloud/aws-security/README.md

@@ -392,4 +392,3 @@ aws ...
 
 
 
-

src/pentesting-cloud/aws-security/aws-basic-information/README.md

@@ -389,4 +389,3 @@ If you are looking for something **similar** to this but for the **browser** you
 
 
 
-

src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md

@@ -132,4 +132,3 @@ In order to specify **which service account should be able to assume the role,**
 
 
 
-

src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md

@@ -20,4 +20,3 @@ These are the permissions you need on each AWS account you want to audit to be a
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/README.md

@@ -4,5 +4,3 @@
 
 
 
-
-

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md

@@ -35,4 +35,3 @@ Or just remove the use of API keys.
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md

@@ -45,4 +45,3 @@ By default this is disabled:
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md

@@ -66,4 +66,3 @@ The compromised instances or Lambda functions can periodically check the C2 tabl
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md

@@ -57,4 +57,3 @@ Create a peering connection between the victim VPC and the attacker VPC so he wi
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md

@@ -100,4 +100,3 @@ aws ecr put-replication-configuration \
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

@@ -102,4 +102,3 @@ aws ecs create-service --service-name "undocumented-service" --task-definition "
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md

@@ -24,4 +24,3 @@ You could **create an access point** (with root access to `/`) accessible from a
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md

@@ -80,4 +80,3 @@ aws elasticbeanstalk update-environment --environment-name my-env --option-setti
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md

@@ -52,4 +52,3 @@ If the account is already trusting a common identity provider (such as Github) t
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -42,4 +42,3 @@ aws kms list-grants --key-id <key-id>
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md

@@ -67,4 +67,3 @@ Here you have some ideas to make your **presence in AWS more stealth by creating
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md

@@ -45,4 +45,3 @@ The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md

@@ -133,4 +133,3 @@ aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --state
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md

@@ -36,4 +36,3 @@ If domains are configured:
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md

@@ -34,4 +34,3 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md

@@ -28,4 +28,3 @@ Although usually ACLs of buckets are disabled, an attacker with enough privilege
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md

@@ -56,4 +56,3 @@ def generate_password():
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -84,4 +84,3 @@ aws sns subscribe --region <region> \
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md

@@ -42,4 +42,3 @@ The following policy gives everyone in AWS access to everything in the queue cal
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md

@@ -4,5 +4,3 @@
 
 
 
-
-

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md

@@ -24,4 +24,3 @@ If the AWS account is using aliases to call step functions it would be possible
 
 
 
-

src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md

@@ -134,4 +134,3 @@ Write-Host "Role juggling check complete."
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/README.md

@@ -4,5 +4,3 @@
 
 
 
-
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md

@@ -149,4 +149,3 @@ aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_K
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md

@@ -34,4 +34,3 @@ You can check the [**tf code to recreate this scenarios here**](https://github.c
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md

@@ -87,4 +87,3 @@ aws codebuild delete-source-credentials --arn <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md

@@ -191,4 +191,3 @@ aws codebuild start-build --project-name <proj-name>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md

@@ -23,4 +23,3 @@ aws controltower enable-control --control-identifier <arn_control_id> --target-i
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md

@@ -98,4 +98,3 @@ A template for the policy document can be seen here:
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md

@@ -352,4 +352,3 @@ bashCopy codeaws dynamodbstreams get-records \
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -480,4 +480,3 @@ if __name__ == "__main__":
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md

@@ -144,4 +144,3 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md

@@ -18,4 +18,3 @@ For more information and access to the [**malmirror script**](https://github.com
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md

@@ -99,4 +99,3 @@ aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-i
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md

@@ -66,4 +66,3 @@ The EC2 instance will probably also have the permission `ecr:GetAuthorizationTok
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md

@@ -57,4 +57,3 @@ aws efs delete-access-point --access-point-id <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md

@@ -158,4 +158,3 @@ So, if an **attacker compromises a cluster using fargate** and **removes all the
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md

@@ -83,4 +83,3 @@ aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md

@@ -106,4 +106,3 @@ A common way to avoid Confused Deputy problems is the use of a condition with `A
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md

@@ -136,4 +136,3 @@ aws kms schedule-key-deletion \
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md

@@ -32,4 +32,3 @@ Abusing Lambda Layers it's also possible to abuse extensions and persist in the
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md

@@ -66,4 +66,3 @@ For more info check [https://github.com/carlospolop/lambda_bootstrap_switcher](h
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md

@@ -33,4 +33,3 @@ Check out the Lightsail privesc options to learn different ways to access potent
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation.md

@@ -22,4 +22,3 @@ aws organizations deregister-account --account-id <account_id> --region <region>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md

@@ -95,4 +95,3 @@ aws rds start-export-task --export-task-identifier attacker-export-task --source
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md

@@ -41,4 +41,3 @@ Finally, the attacker could upload a final file, usually named "ransom-note.txt,
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -52,4 +52,3 @@ aws secretsmanager delete-secret \
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md

@@ -86,4 +86,3 @@ Still to test.
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md

@@ -83,4 +83,3 @@ aws sns untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md

@@ -90,4 +90,3 @@ arduinoCopy codeaws sqs remove-permission --queue-url <value> --label <value>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md

@@ -28,4 +28,3 @@ aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md

@@ -77,4 +77,3 @@ aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md

@@ -51,7 +51,6 @@ resp=$(curl -s "$federation_endpoint" \
 signin_token=$(echo -n $resp | jq -r '.SigninToken' | tr -d '\n' | jq -sRr @uri)
 
 
-
 # Give the URL to login
 echo -n "https://signin.aws.amazon.com/federation?Action=login&Issuer=example.com&Destination=https%3A%2F%2Fconsole.aws.amazon.com%2F&SigninToken=$signin_token"
 ```
@@ -107,4 +106,3 @@ response = client.get_secret_value(SecretId="flag_secret") print(response['Secre
 
 
 
-

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md

@@ -16,4 +16,3 @@ For more information:
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md

@@ -25,4 +25,3 @@ The way to escalate your privileges in AWS is to have enough permissions to be a
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md

@@ -110,4 +110,3 @@ aws apigateway update-vpc-link --vpc-link-id $VPC_LINK_ID --patch-operations op=
 
 
 
-

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md

@@ -12,4 +12,3 @@ TODO
 
 
 
-