diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 5e04d31db..4cd5423ae 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -14,3 +14,5 @@ In any case, thanks for contributing to HackTricks! + + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md index 855759013..c3d2d6581 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md @@ -67,3 +67,4 @@ This tool allows to perform several actions like register a machine in Azure AD + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/README.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/README.md index ec734cb69..d7c80a0d6 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/README.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/README.md @@ -62,3 +62,4 @@ Get-ADSyncConnector + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-cloud-kerberos-trust.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-cloud-kerberos-trust.md index 0b8debf3e..43d1ab869 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-cloud-kerberos-trust.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-cloud-kerberos-trust.md @@ -51,3 +51,4 @@ Check it in the original post: [https://dirkjanm.io/obtaining-domain-admin-from- + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-default-applications.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-default-applications.md index 593b0222a..4a675454d 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-default-applications.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-default-applications.md @@ -11,3 +11,4 @@ The blog post discusses a privilege escalation vulnerability in Azure AD, allowi + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-synchronising-new-users.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-synchronising-new-users.md index 4af67011b..d37da6b98 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-synchronising-new-users.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/az-synchronising-new-users.md @@ -34,3 +34,4 @@ An automatically, this user will be **synced from AzureAD to the on-prem AD user + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/federation.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/federation.md index 480c5f22b..795c84728 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/federation.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/federation.md @@ -163,3 +163,4 @@ Open-AADIntOffice365Portal -ImmutableID "aodilmsic30fugCUgHxsnK==" -Issuer http: + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md index 0bf61effe..39d696ca3 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/phs-password-hash-sync.md @@ -124,3 +124,4 @@ seamless-sso.md + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/pta-pass-through-authentication.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/pta-pass-through-authentication.md index f6edf1214..673ad3ae9 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/pta-pass-through-authentication.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/pta-pass-through-authentication.md @@ -72,3 +72,4 @@ seamless-sso.md + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/seamless-sso.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/seamless-sso.md index 289951b91..1f9bd23b2 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/seamless-sso.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/azure-ad-connect-hybrid-identity/seamless-sso.md @@ -119,3 +119,4 @@ python rbdel.py -u \\ -p azureadssosvc$ + diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/pass-the-prt.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/pass-the-prt.md index b09d8a841..d159f3a18 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/pass-the-prt.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/pass-the-prt.md @@ -286,3 +286,4 @@ roadrecon auth --prt-cookie --prt-context --derives-key --permissions rwd --expiry 2024- + diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md index 95dedb925..c37841ec0 100644 --- a/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md +++ b/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md @@ -43,3 +43,4 @@ az storage blob service-properties delete-policy update \ + diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md index 8d020a39e..60de45178 100644 --- a/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md +++ b/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md @@ -27,3 +27,4 @@ An attacker could get access to the instances and backdoor them: + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/README.md b/src/pentesting-cloud/azure-security/az-post-exploitation/README.md index 53b20671b..df880f81d 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/README.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/README.md @@ -4,3 +4,4 @@ + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md index 9c3d0b8c6..adcfcaf00 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md @@ -47,3 +47,4 @@ This would allow to delete objects inside the storage account which might **inte + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md index b3d3cf90f..3a37d111e 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md @@ -50,3 +50,4 @@ This would allow to delete file inside the shared filesystem which might **inter + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md index e511ad994..049528647 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md @@ -19,3 +19,4 @@ For more information about function apps check: + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md index d9357b643..1b334a556 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md @@ -113,3 +113,4 @@ az keyvault secret restore --vault-name --file + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md index 03c59a8d5..322fd1da6 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md @@ -91,3 +91,4 @@ az storage queue policy set --name --permissions rwd --expiry 2024- + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md index 2fdb2dc55..d8ca7737b 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md @@ -101,3 +101,4 @@ Take a look here: + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md index 7a8b1c1d5..9fba118a5 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md @@ -104,3 +104,4 @@ az sql db import --admin-user \ + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md index 06e5df01e..c47490f51 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md @@ -66,3 +66,4 @@ This would allow to delete file inside the shared filesystem which might **inter + diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md index 900a5d9ce..3fc63f419 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md @@ -183,3 +183,4 @@ az vm application set \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md index 662469fc5..fcdea339c 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md @@ -4,3 +4,4 @@ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md index 6a805ae88..c3162b93f 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md @@ -41,3 +41,4 @@ ssh root@127.0.0.1 -p 39895 + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md index f8c4359f3..1a5a5b97d 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md @@ -84,3 +84,4 @@ az rest --method PUT \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md index 940e80bce..b2c48c1bb 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md @@ -359,3 +359,4 @@ az rest --method GET \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md index 27bf965d0..ac0700eae 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md @@ -183,3 +183,4 @@ $data = Get-SharePointFilesFromGraph -authentication $token $data[0].downloadUrl + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md index 322d18348..3822d7092 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md @@ -52,3 +52,4 @@ az rest --method GET \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md index dd5b81f35..f80366626 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md @@ -459,3 +459,4 @@ az functionapp deployment source config \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md index 2db843851..5cf3cca37 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md @@ -36,3 +36,4 @@ az keyvault set-policy \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md index db0b051cb..59d5df969 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md @@ -75,3 +75,4 @@ az storage queue policy set --name --permissions rwd --expiry 2024- + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md index bee8aff28..e0d771340 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md @@ -156,3 +156,4 @@ az servicebus namespace authorization-rule update \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md index 76dbfdcfd..1c0394a90 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md @@ -113,3 +113,4 @@ az sql server azure-ad-only-auth disable \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md index c2545f9e2..fa09c59ea 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md @@ -154,3 +154,4 @@ az storage share-rm restore \ + diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md index 6d8ba6e74..f86886967 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md @@ -384,3 +384,4 @@ According to the [**docs**](https://learn.microsoft.com/en-us/azure/role-based-a + diff --git a/src/pentesting-cloud/azure-security/az-services/README.md b/src/pentesting-cloud/azure-security/az-services/README.md index 3a40a9dff..83201c0f0 100644 --- a/src/pentesting-cloud/azure-security/az-services/README.md +++ b/src/pentesting-cloud/azure-security/az-services/README.md @@ -75,3 +75,4 @@ def main(req: func.HttpRequest) -> func.HttpResponse: + diff --git a/src/pentesting-cloud/azure-security/az-services/az-acr.md b/src/pentesting-cloud/azure-security/az-services/az-acr.md index 800b03b30..bd31ec575 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-acr.md +++ b/src/pentesting-cloud/azure-security/az-services/az-acr.md @@ -54,3 +54,4 @@ docker pull .azurecr.io/: + diff --git a/src/pentesting-cloud/azure-security/az-services/az-app-service.md b/src/pentesting-cloud/azure-security/az-services/az-app-service.md index d18a4d6ee..5663c68cb 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-app-service.md +++ b/src/pentesting-cloud/azure-security/az-services/az-app-service.md @@ -216,3 +216,4 @@ git clone 'https://:@name.scm.azurewebsites.net/repo-name.gi + diff --git a/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md b/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md index e0cf6a053..e68ecfe97 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md +++ b/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md @@ -42,3 +42,4 @@ Get-ApplicationProxyAssignedUsersAndGroups -ObjectId + diff --git a/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md b/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md index 6fcf24ecc..53aad263f 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md +++ b/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md @@ -33,3 +33,4 @@ cat | Select-String password + diff --git a/src/pentesting-cloud/azure-security/az-services/az-automation-account/README.md b/src/pentesting-cloud/azure-security/az-services/az-automation-account/README.md index 43e03e664..575904f2d 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-automation-account/README.md +++ b/src/pentesting-cloud/azure-security/az-services/az-automation-account/README.md @@ -180,3 +180,4 @@ $response = Invoke-WebRequest -Method Post -Uri $uri -Body $body + diff --git a/src/pentesting-cloud/azure-security/az-services/az-automation-account/az-state-configuration-rce.md b/src/pentesting-cloud/azure-security/az-services/az-automation-account/az-state-configuration-rce.md index a1c9b0e78..c8f100524 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-automation-account/az-state-configuration-rce.md +++ b/src/pentesting-cloud/azure-security/az-services/az-automation-account/az-state-configuration-rce.md @@ -67,3 +67,4 @@ The successful execution of this process opens numerous possibilities for furthe + diff --git a/src/pentesting-cloud/azure-security/az-services/az-azuread.md b/src/pentesting-cloud/azure-security/az-services/az-azuread.md index 145e12b7b..43e618a54 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-azuread.md +++ b/src/pentesting-cloud/azure-security/az-services/az-azuread.md @@ -1033,3 +1033,4 @@ The default mode is **Audit**: + diff --git a/src/pentesting-cloud/azure-security/az-services/az-file-shares.md b/src/pentesting-cloud/azure-security/az-services/az-file-shares.md index 92ec2c2d4..aa23c5ade 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-file-shares.md +++ b/src/pentesting-cloud/azure-security/az-services/az-file-shares.md @@ -174,3 +174,4 @@ Same as storage persistence: + diff --git a/src/pentesting-cloud/azure-security/az-services/az-function-apps.md b/src/pentesting-cloud/azure-security/az-services/az-function-apps.md index 4d5ad8bba..a42048cc7 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-function-apps.md +++ b/src/pentesting-cloud/azure-security/az-services/az-function-apps.md @@ -268,3 +268,4 @@ az rest --url "https://management.azure.com//resourceGroups/ -Name + diff --git a/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md b/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md index b6e7dc37c..fde42efc9 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md +++ b/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md @@ -58,3 +58,4 @@ az group list --subscription "" --output table + diff --git a/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md b/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md index bd7e68a13..be83e0172 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md +++ b/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md @@ -97,3 +97,4 @@ $queueMessage.Value + diff --git a/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md b/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md index 4e1d7d1f9..72d110943 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md +++ b/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md @@ -102,3 +102,4 @@ az servicebus namespace authorization-rule keys list --resource-group .database.windows.net -U -P # List pools of DB + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md index 2b82e8236..623fb3364 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md @@ -83,3 +83,4 @@ It's also possible to launch a **recovery console** to run commands inside the h + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md index e0c7030d6..ee4bff90b 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md @@ -62,3 +62,4 @@ doctl serverless activations result # get only the response resu + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md index 67b2ba40b..51594ad82 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md @@ -21,3 +21,4 @@ doctl compute image list + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md index b838e21e3..a70d80df8 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md @@ -41,3 +41,4 @@ doctl kubernetes cluster list-associated-resources + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md index f0e752871..8f8ff38c5 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md @@ -47,3 +47,4 @@ doctl compute firewall remove-droplets --droplet-ids + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md index 3f8adcdc4..c59ae89b6 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md @@ -25,3 +25,4 @@ doctl projects resources list # Get all the resources of a project + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md index faf452f36..62cd23d9a 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md @@ -48,3 +48,4 @@ aws s3 ls --endpoint=https://fra1.digitaloceanspaces.com s3://uniqbucketname + diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md index 34f57bb65..0e97a21d2 100644 --- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md +++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md @@ -17,3 +17,4 @@ compute volume list + diff --git a/src/pentesting-cloud/gcp-security/README.md b/src/pentesting-cloud/gcp-security/README.md index 6ee2826c5..7eca73262 100644 --- a/src/pentesting-cloud/gcp-security/README.md +++ b/src/pentesting-cloud/gcp-security/README.md @@ -247,3 +247,4 @@ gcloud config unset auth/access_token_file + diff --git a/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md b/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md index 28c82cfe4..bf319752e 100644 --- a/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md @@ -232,3 +232,4 @@ As defined by terraform in [https://registry.terraform.io/providers/hashicorp/go + diff --git a/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md b/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md index 7264de52e..eb71bcd6c 100644 --- a/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md +++ b/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md @@ -155,3 +155,4 @@ jobs: + diff --git a/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md b/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md index f80fca133..c6bd755dc 100644 --- a/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md +++ b/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md @@ -146,3 +146,4 @@ roles/bigquery.metadataViewer + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/README.md b/src/pentesting-cloud/gcp-security/gcp-persistence/README.md index 29e628792..c424c72b3 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/README.md @@ -4,3 +4,4 @@ + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md index d763d87cb..8198c2bdd 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md @@ -23,3 +23,4 @@ Check how to do this in: + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md index 6d0ee2e1f..3f94b1830 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md @@ -23,3 +23,4 @@ If yoi could just modify the code of a running version or create a new one yo co + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md index 56d9bf760..3cc8b40c7 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md @@ -44,3 +44,4 @@ https://book.hacktricks.xyz/pentesting-web/dependency-confusion + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md index 8d5d641e9..41f202631 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md @@ -23,3 +23,4 @@ Grant further access over datasets, tables, rows and columns to compromised user + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md index 25e82bdf1..da1e9d48b 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md @@ -21,3 +21,4 @@ For more info about Cloud Functions check: + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md index 144b68b8a..adc05d3aa 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md @@ -27,3 +27,4 @@ Create a backdoored Service or Job + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md index 6484237a5..492e00c06 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md @@ -71,3 +71,4 @@ But you can find further information in [https://github.com/FrancescoDiSalesGith + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md index 1b26d09d9..1eb04c3e0 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md @@ -39,3 +39,4 @@ For more information check the technique in: + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md index ac3919ffa..3e8e59e3f 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md @@ -21,3 +21,4 @@ For more informatoin about Compute and VPC (Networking) check: + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md index 58f285177..c5188d005 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md @@ -55,3 +55,4 @@ gcloud dataflow $NAME_TEMPLATE run testing \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md index 0ef71caf8..978252daf 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md @@ -23,3 +23,4 @@ gcp-filestore-persistence.md + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md index dfdec0c54..8c262bfbb 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md @@ -23,3 +23,4 @@ gcloud logging sinks create --log-filter="FILTER_CONDI + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md index 03f057015..8d4ac8daa 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md @@ -106,3 +106,4 @@ Some remediations for these techniques are explained in [https://www.netskope.co + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md index 260bd0f1d..3a30b18b3 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md @@ -24,3 +24,4 @@ An attacker could update the secret to: + diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md index af1e5e00f..733ea0042 100644 --- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md +++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md @@ -40,3 +40,4 @@ Another exploit script for this method can be found [here](https://github.com/Rh + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md index 059d4cbea..182dd08c2 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md @@ -4,3 +4,4 @@ + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md index 94fbf3f8a..0207914f6 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md @@ -45,3 +45,4 @@ Modify source code to steal credentials if they are being sent or perform a defa + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md index 2ddce1d54..60ffe6818 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md @@ -23,3 +23,4 @@ The Post Exploitation and Privesc techniques of Artifact Registry were mixed in: + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md index ba5350b4b..91a3e9727 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md @@ -31,3 +31,4 @@ curl -X POST \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md index 2cf26d140..18b9f5974 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md @@ -130,3 +130,4 @@ def injection(): + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md index 9a1b57846..50767c3b1 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md @@ -25,3 +25,4 @@ Modify the run image to steal information and redeploy the new version (just upl + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md index b1ea7c2ce..edb660aa3 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md @@ -104,3 +104,4 @@ The instructions were copied from [https://github.com/FrancescoDiSalesGithub/Goo + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md index 33bfb12e4..fc57091b8 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md @@ -105,3 +105,4 @@ gcloud sql databases delete --instance + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md index f6d39a8f0..155829e0d 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md @@ -122,3 +122,4 @@ If you **cannot give access to a external project** to the snapshot or disk, you + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md index bd24bbb0e..4d2f9e58f 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md @@ -102,3 +102,4 @@ gcloud filestore backups create \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md index f7d393701..0827b15b7 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md @@ -31,3 +31,4 @@ This is the **highest level you can assign using the gcloud tool**. + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md index 3dfd31284..2e73e26cc 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md @@ -259,3 +259,4 @@ print('Verified:', verified) + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md index c6bdd5376..72c84217d 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md @@ -135,3 +135,4 @@ gcloud logging sinks update SINK_NAME --no-use-partitioned-tables + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md index 4d0227c77..c81e01f78 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md @@ -116,3 +116,4 @@ gcloud alpha monitoring channels update CHANNEL_ID --update-channel-labels=email + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md index 1d24f627e..9a7691f27 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md @@ -142,3 +142,4 @@ gcloud pubsub subscriptions seek YOUR_SUBSCRIPTION_NAME \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md index a12db02ed..c4a538f67 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md @@ -24,3 +24,4 @@ gcloud secrets versions access 1 --secret="" + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md index 92b0cee3e..73feab877 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md @@ -60,3 +60,4 @@ gcloud scc findings update `myFinding` --organization=123456 --source=5678 --sta + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md index 3377adb88..ff7df87ed 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md @@ -36,3 +36,4 @@ To access open buckets via browser, access the URL `https://.storag + diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md index be0e1a5c5..5f28ca24e 100644 --- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md +++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md @@ -23,3 +23,4 @@ The post exploitation techniques are actually the same ones as the ones shared i + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md index 9da5e566e..4c047d82e 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md @@ -76,3 +76,4 @@ gcp-local-privilege-escalation-ssh-pivoting.md + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md index 600b14bdd..34722c053 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md @@ -80,3 +80,4 @@ Check the following page to learn how to do this, although this action belongs t + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md index ecf58d98f..344367f82 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md @@ -114,3 +114,4 @@ It might be possible that performing a **Race Condition attack like with the buc + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md index 64222603a..6586395cd 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md @@ -175,3 +175,4 @@ It might be possible that performing a **Race Condition attack like with the buc + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md index 34f4bdf00..296e527cc 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md @@ -60,3 +60,4 @@ EOD + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md index aa5752bc9..04a8a3b20 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md @@ -118,3 +118,4 @@ bq query --nouse_legacy_sql 'DROP ALL ROW ACCESS POLICIES ON `. + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md index bea78fd35..d6c4a08b8 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md @@ -119,3 +119,4 @@ gcloud auth activate-service-account --key-file=/tmp/lab.json + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md index 02733bcb0..f1467f546 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md @@ -127,3 +127,4 @@ TODO: Check what is possible to compromise by uploading data + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md index f76da5809..fa5cf644b 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md @@ -150,3 +150,4 @@ Following this link you find some [**ideas to try to bypass access scopes**](../ + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md index f74387441..3a3149999 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md @@ -102,3 +102,4 @@ It's possible to broaden the reach of SSH access to multiple Virtual Machines (V + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md index ea10ba464..646982985 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md @@ -93,3 +93,4 @@ For more information [**follow this link**](../../kubernetes-security/abusing-ro + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md index f77f14f62..dd962e0d2 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md @@ -31,3 +31,4 @@ This is like the previous abuse but instead of directly creating a new deploymen + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md index 4ad8b082e..baa82bee3 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md @@ -146,3 +146,4 @@ You can find an example on how to create and OpenID token behalf a service accou + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md index 1ca91fe11..5f8444fcf 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md @@ -90,3 +90,4 @@ Replace `[YOUR_PROJECT_ID]` and `[SERVICE_ACCOUNT_EMAIL]` with your project ID a + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md index 36ef69fea..5a950b396 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md @@ -100,3 +100,4 @@ grep -Pzr '(?s)
' \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md index 2a4e5729a..2d6907403 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md @@ -27,3 +27,4 @@ This permission will usually let you **access or modify a Service Account in som + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md index b3d2e3034..be2c57e5b 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md @@ -58,3 +58,4 @@ This step authorizes the public key, enabling SSH connection with the correspond + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md index c025a23fe..a49520262 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md @@ -27,3 +27,4 @@ A python script for this method can be found [here](https://github.com/RhinoSecu + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md index 9daf0bde5..ae017d7cd 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md @@ -39,3 +39,4 @@ Give yourself any of the preiovus permissions + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md index b602b36dc..9db772b93 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md @@ -21,3 +21,4 @@ Like in the exploitation of `iam.serviceAccounts.setIamPolicy`, this permission + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md index d6318811c..58bd71fe2 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md @@ -91,3 +91,4 @@ gcloud beta run jobs execute job-name --region --update-env-vars="PYTHO + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md index e635e1265..d7cd30d06 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md @@ -40,3 +40,4 @@ gcloud secrets add-iam-policy-binding \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md index 934a814ed..c7f1518f6 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md @@ -59,3 +59,4 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md index ab9d4b2ae..345df8e21 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md @@ -89,3 +89,4 @@ gcloud source project-configs update --remove-topic=UPDATE_TOPIC + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md index 62ab9cb89..8c2e17374 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md @@ -119,3 +119,4 @@ The mentioned attack can be performed in a lot of different ways, all of them st + diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md index f4c25540e..269f5dbe4 100644 --- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md +++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md @@ -109,3 +109,4 @@ With this permission instead of `workflows.workflows.create` it's possible to up + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/README.md b/src/pentesting-cloud/gcp-security/gcp-services/README.md index 616e3f78c..be2b8d7ab 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/README.md @@ -4,3 +4,4 @@ + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md index fd5d80305..431881e18 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md @@ -24,3 +24,4 @@ gcloud ai-platform jobs describe + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md index 6d7e7a204..c2c3264f5 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md @@ -46,3 +46,4 @@ gcloud services api-keys list --show-deleted + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md index 03e6fde03..474ac595e 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md @@ -119,3 +119,4 @@ gcloud app ssl-certificates describe + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md index 4e9514b90..32f822923 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md @@ -94,3 +94,4 @@ gcloud artifacts docker images list-vulnerabilities projects//locatio + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md index 1959d2a89..793089880 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md @@ -37,3 +37,4 @@ gcloud batch tasks describe projects//locations//jobs/.INFORMATION_SCHEMA.SC + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md index 423437992..c473545fd 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md @@ -34,3 +34,4 @@ gcloud bigtable app-profiles describe --instance + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md index de8d1650c..2e135199f 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md @@ -173,3 +173,4 @@ done + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md index 36f87175d..cd873b75b 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md @@ -110,3 +110,4 @@ In the following page, you can check how to **abuse cloud function permissions t + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md index 91e11a44c..e4bf6e901 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md @@ -113,3 +113,4 @@ In the following page, you can check how to **abuse cloud run permissions to esc + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md index d2fc063c8..c7af021b1 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md @@ -48,3 +48,4 @@ gcloud scheduler jobs describe --location us-central1 + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md index f6a7f6553..4ad55348d 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md @@ -30,3 +30,4 @@ Note that Cloud Shell can be **easily disabled** for the organization. + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md index 421207574..1ee2c141c 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md @@ -91,3 +91,4 @@ gcloud sql backups describe --instance + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md index a4e7edbcb..8d252b1b2 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md @@ -45,3 +45,4 @@ In the following page you can check how to **abuse composer permissions to escal + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md index 0a943c01f..81079877c 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md @@ -233,3 +233,4 @@ Check the Compute Instances privilege escalation section. + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md index 10c9af0cc..88f0ab5d7 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md @@ -105,3 +105,4 @@ A Google-managed encryption key is used by default a but a Customer-managed encr + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md index 8fe32acd3..6c3bd0dd9 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md @@ -87,3 +87,4 @@ These are the needed permissions: + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md index df3164830..cef7f77bf 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md @@ -106,3 +106,4 @@ Even if the API **doesn't allow to modify resources**, it could be possible to f + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md index 5a178d0b3..f3e318e91 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md @@ -27,3 +27,4 @@ gcloud dns policies list + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md index 559326596..56956e2ab 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md @@ -76,3 +76,4 @@ There aren't ways to escalate privileges in GCP directly abusing this service, b + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md index 3b7157d06..0024f3865 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md @@ -79,3 +79,4 @@ You may be able to access some interesting information + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md index 9b7d2b421..c907b971a 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md @@ -19,3 +19,4 @@ gcloud firestore export gs://my-source-project-export/export-20190113_2109 --col + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md index 789679201..74cd5a7aa 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md @@ -228,3 +228,4 @@ In the following page you can check how to **abuse org policies permissions to e + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md index 4d42e1ef6..d07d7ba82 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md @@ -84,3 +84,4 @@ gcloud kms decrypt --ciphertext-file=[INFILE] \ + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md index 71acd1a6e..3879984d4 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md @@ -148,3 +148,4 @@ There aren't logs of **`testIamPermissions`**: + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md index 3c1793f76..ff635eb36 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md @@ -23,3 +23,4 @@ gcloud redis instances export gs://my-bucket/my-redis-instance.rdb my-redis-inst + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md index 83f163400..2aa724fd5 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md @@ -59,3 +59,4 @@ gcloud alpha monitoring channels describe + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md index fa73d5f0a..d711582d8 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md @@ -96,3 +96,4 @@ gcloud pubsub lite-operations describe + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md index f56c2fcb0..637a1a6ef 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md @@ -55,3 +55,4 @@ An attacker could update the secret to **stop rotations** (so it won't be modifi + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md index b5aada876..4e4bb09f6 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md @@ -94,3 +94,4 @@ gcp-secrets-manager-enum.md + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md index 330cf685b..2fba55452 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md @@ -69,3 +69,4 @@ git add, commit, push... + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md index 5c3d70ee5..13d17d395 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md @@ -33,3 +33,4 @@ gcloud spanner instance-configs describe + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md index 91c145171..2f8ffd0bb 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md @@ -35,3 +35,4 @@ gcloud logging buckets list + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md index e584d6448..3b1c0d163 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md @@ -158,3 +158,4 @@ In the following page you can check how to **abuse storage permissions to escala + diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md index fc11f13dd..825095b4a 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md @@ -40,3 +40,4 @@ gcloud workflows executions describe projects//locations/ + diff --git a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md index f70b027ee..33e2849cc 100644 --- a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md @@ -173,3 +173,4 @@ Abusing the **google groups privesc** you might be able to escalate to a group w + diff --git a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md index 19656923b..4964e94bf 100644 --- a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md +++ b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md @@ -30,3 +30,4 @@ This is how a GCP Service Account can access Google APIs on behalf of other iden + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md index 141e307cf..8783f3b55 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md @@ -20,3 +20,4 @@ Note that other cloud resources could be searched for and that some times these + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md index 8fe218ed7..a04a37339 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md @@ -54,3 +54,4 @@ As you might not know which APIs are enabled in the project, it would be interes + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md index 53211e47c..d4c16254d 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md @@ -27,3 +27,4 @@ You could use tools like the ones indicated in: + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md index b2a9af31a..485af241f 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md @@ -23,3 +23,4 @@ Check the following page: + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md index 6bfa43ce0..698b257de 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md @@ -44,3 +44,4 @@ Moreover, it's easy to see if some cloudbuild execution needs to be performed wh + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md index bb2e65cbb..91bac89d4 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md @@ -79,3 +79,4 @@ done + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md index 521412f9d..2c91a5744 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md @@ -61,3 +61,4 @@ done + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md index fac47ccf9..4f2db1f8a 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md @@ -27,3 +27,4 @@ Remember that with some privileges it's possible to **list all the database user + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md index 8e8abfa0e..fcc21384d 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md @@ -27,3 +27,4 @@ If a GCP instance has a vulnerable exposed service an attacker could abuse it to + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md index 5dde2c77f..bef8e5471 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md @@ -112,3 +112,4 @@ ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal test + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md index 3d831b51a..01a38f1e7 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md @@ -22,3 +22,4 @@ If an external repository is being used via Source Repositories an attacker coul + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md index f6e17261a..e4ccd9372 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md @@ -75,3 +75,4 @@ done + diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md index f6cf4c708..0a48ff4e3 100644 --- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md +++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md @@ -33,3 +33,4 @@ Another attack would be to **remove the bucket an d recreate it in your account + diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/README.md b/src/pentesting-cloud/ibm-cloud-pentesting/README.md index 93a9a05c3..751460b51 100644 --- a/src/pentesting-cloud/ibm-cloud-pentesting/README.md +++ b/src/pentesting-cloud/ibm-cloud-pentesting/README.md @@ -40,3 +40,4 @@ https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/clou + diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md index a11fbec57..d6b87fed3 100644 --- a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md +++ b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md @@ -74,3 +74,4 @@ When creating the policy you need to choose: + diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md index f0d1a605a..6a48521db 100644 --- a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md +++ b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md @@ -31,3 +31,4 @@ Overall, the high level of security provided by HSMs makes it **very difficult t + diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md index eb99bff8f..81beebe59 100644 --- a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md +++ b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md @@ -44,3 +44,4 @@ Overall, LinuxONE is a powerful and secure platform that is well-suited for runn + diff --git a/src/pentesting-cloud/kubernetes-security/README.md b/src/pentesting-cloud/kubernetes-security/README.md index 4f7e16ef0..1585a6fb4 100644 --- a/src/pentesting-cloud/kubernetes-security/README.md +++ b/src/pentesting-cloud/kubernetes-security/README.md @@ -82,3 +82,4 @@ kubernetes-pivoting-to-clouds.md + diff --git a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md index 67ebbd554..ccf3d0c53 100644 --- a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md +++ b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md @@ -700,3 +700,4 @@ https://github.com/aquasecurity/kube-bench + diff --git a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md index 0524213fb..284dab905 100644 --- a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md +++ b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md @@ -614,3 +614,4 @@ kubectl delete serviceaccount test-sa + diff --git a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md index 606d7a287..eb1f71a53 100644 --- a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md +++ b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md @@ -51,3 +51,4 @@ spec: + diff --git a/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md b/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md index 4a0a3ebc0..f1ecf8c38 100644 --- a/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md +++ b/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md @@ -397,3 +397,4 @@ Off-Menu + + diff --git a/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md b/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md index cc1a49ce0..e2dbe8e5d 100644 --- a/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md +++ b/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md @@ -217,3 +217,4 @@ kubectl get ingresses --all-namespaces -o=yaml + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md b/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md index f4e4ed9e0..b5b809d76 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md @@ -571,3 +571,4 @@ https://www.youtube.com/watch?v=X48VuDVv0do + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md b/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md index 9978c527c..306ad6879 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md @@ -614,3 +614,4 @@ https://www.cyberark.com/resources/threat-research-blog/kubernetes-pentest-metho + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md b/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md index 6f0db6d77..2071e2ac9 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md @@ -120,3 +120,4 @@ https://github.com/external-secrets/external-secrets + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md index 0e7e19ca4..bcf722ca2 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md @@ -176,3 +176,4 @@ You should update your Kubernetes environment as frequently as necessary to have + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md index 7d6ac6206..9c8333fc2 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md @@ -64,3 +64,4 @@ Note that the attributes set in **both SecurityContext and PodSecurityContext**, + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md index 188e55680..4ba49eaca 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md @@ -58,3 +58,4 @@ When a pod is created in the `default` namespace without the label `app: myapp`, + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md index db10b992a..8d53c8213 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md @@ -62,3 +62,4 @@ Another way to bypass policies is to focus on the ValidatingWebhookConfiguration + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md b/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md index a32a97b19..a1c0ea2b7 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md @@ -35,3 +35,4 @@ attacking-kubernetes-from-inside-a-pod.md + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md b/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md index 0972fcc04..42115ed19 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md @@ -292,3 +292,4 @@ It will install agents in the selected pods and gather their traffic information + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md index 5d883761a..a9198c685 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md @@ -78,3 +78,4 @@ When Gatekeeper is deployed in the Kubernetes cluster, it will enforce this poli + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md index c821fd89c..9f1de568c 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md @@ -65,3 +65,4 @@ Another way to bypass constraints is to focus on the ValidatingWebhookConfigurat + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md b/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md index cf64bca6c..584558625 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md @@ -325,3 +325,4 @@ fi + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md b/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md index 3ef90b8f5..1b9d4972c 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md @@ -167,3 +167,4 @@ abusing-roles-clusterroles-in-kubernetes/ + diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md b/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md index 4b1ddd273..1abead777 100644 --- a/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md +++ b/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md @@ -104,3 +104,4 @@ abusing-roles-clusterroles-in-kubernetes/ + diff --git a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md index f339ac821..1e3c22e28 100644 --- a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md +++ b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md @@ -216,3 +216,4 @@ https://labs.f-secure.com/blog/attacking-kubernetes-through-kubelet + diff --git a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md index 7cb68dbd9..18fad4990 100644 --- a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md +++ b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md @@ -111,3 +111,4 @@ Forbidden (user=system:node:ip-172-31-28-172.ec2.internal, verb=get, resource=no + diff --git a/src/pentesting-cloud/openshift-pentesting/README.md b/src/pentesting-cloud/openshift-pentesting/README.md index 10c2e46ac..964370e97 100644 --- a/src/pentesting-cloud/openshift-pentesting/README.md +++ b/src/pentesting-cloud/openshift-pentesting/README.md @@ -21,3 +21,4 @@ openshift-privilege-escalation/ + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md b/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md index fb5103835..02d6c05b5 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md @@ -42,3 +42,4 @@ https://docs.openshift.com/container-platform/3.11/architecture/additional_conce + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md index 6edec0d9f..16eb64898 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md @@ -41,3 +41,4 @@ openshift-jenkins-build-overrides.md + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md index fb2aca679..f892597d0 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md @@ -276,3 +276,4 @@ pipeline { + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md index 43ad1ade4..f15168c89 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md @@ -21,3 +21,4 @@ openshift-scc-bypass.md + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md index f591b8026..7b4c66749 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md @@ -25,3 +25,4 @@ https://github.com/maxDcb/OpenShiftGrapher + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md index 794430e16..6b2ad955b 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md @@ -140,3 +140,4 @@ To bypass GateKeeper's rules and set this label to execute a cluster takeover, * + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md index 45080c799..00e62231e 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md @@ -77,3 +77,4 @@ spec: + diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-scc.md b/src/pentesting-cloud/openshift-pentesting/openshift-scc.md index 46fb57c6f..177d26ee9 100644 --- a/src/pentesting-cloud/openshift-pentesting/openshift-scc.md +++ b/src/pentesting-cloud/openshift-pentesting/openshift-scc.md @@ -70,3 +70,4 @@ openshift-privilege-escalation/openshift-scc-bypass.md + diff --git a/src/pentesting-cloud/workspace-security/README.md b/src/pentesting-cloud/workspace-security/README.md index a0f6a7e9b..67970fc27 100644 --- a/src/pentesting-cloud/workspace-security/README.md +++ b/src/pentesting-cloud/workspace-security/README.md @@ -75,3 +75,4 @@ gws-persistence.md + diff --git a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md index 2e2a9b874..8ce328fa0 100644 --- a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md +++ b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md @@ -167,3 +167,4 @@ It's possible to do something using gcloud instead of the web console, check: + diff --git a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md index d6f166da8..e3a210692 100644 --- a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md +++ b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md @@ -237,3 +237,4 @@ Moreover, if someone **shared** with you a document with **editor access**, you + diff --git a/src/pentesting-cloud/workspace-security/gws-persistence.md b/src/pentesting-cloud/workspace-security/gws-persistence.md index 1061458fd..d211429a7 100644 --- a/src/pentesting-cloud/workspace-security/gws-persistence.md +++ b/src/pentesting-cloud/workspace-security/gws-persistence.md @@ -184,3 +184,4 @@ gws-google-platforms-phishing/gws-app-scripts.md + diff --git a/src/pentesting-cloud/workspace-security/gws-post-exploitation.md b/src/pentesting-cloud/workspace-security/gws-post-exploitation.md index a78597271..fb5f73b50 100644 --- a/src/pentesting-cloud/workspace-security/gws-post-exploitation.md +++ b/src/pentesting-cloud/workspace-security/gws-post-exploitation.md @@ -76,3 +76,4 @@ You can also find emails by searching through all the user's invoices in [**http + diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md index e7f4b93ae..433c55986 100644 --- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md +++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md @@ -60,3 +60,4 @@ gws-admin-directory-sync.md + diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md index 15e78a699..182f339c3 100644 --- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md +++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md @@ -342,3 +342,4 @@ curl -X POST \ + diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md index db7a19b1b..40a3c73a8 100644 --- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md +++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md @@ -942,3 +942,4 @@ It's possible to find the key components of this in the Chromium source code: + diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md index f94757b63..6f815b9fa 100644 --- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md +++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md @@ -194,3 +194,4 @@ Which is the same one you get if you don't indicate any scope. + diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md index a74528e3b..6d71a6d82 100644 --- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md +++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md @@ -59,3 +59,4 @@ I also don't know where does Google store the AD credentials or EntraID token an +