Translated ['src/README.md', 'src/banners/hacktricks-training.md', 'src/

2026-02-05 03:16:37 -08:00 · 2024-12-31 20:24:43 +00:00
parent 10e2881a9b
commit 9ce07d92a3
245 changed files with 9883 additions and 12659 deletions
--- a/src/pentesting-cloud/pentesting-cloud-methodology.md
+++ b/src/pentesting-cloud/pentesting-cloud-methodology.md
@@ -6,43 +6,42 @@

 ## Basic Methodology

-Each cloud has its own peculiarities but in general there are a few **common things a pentester should check** when testing a cloud environment:
+Svaka cloud platforma ima svoje specifičnosti, ali generalno postoji nekoliko **zajedničkih stvari koje pentester treba da proveri** prilikom testiranja cloud okruženja:

- **Benchmark checks**
-  - This will help you **understand the size** of the environment and **services used**
-  - It will allow you also to find some **quick misconfigurations** as you can perform most of this tests with **automated tools**
- **Services Enumeration**
-  - You probably won't find much more misconfigurations here if you performed correctly the benchmark tests, but you might find some that weren't being looked for in the benchmark test.
-  - This will allow you to know **what is exactly being used** in the cloud env
-  - This will help a lot in the next steps
- **Check exposed assets**
-  - This can be done during the previous section, you need to **find out everything that is potentially exposed** to the Internet somehow and how can it be accessed.
-    - Here I'm taking **manually exposed infrastructure** like instances with web pages or other ports being exposed, and also about other **cloud managed services that can be configured** to be exposed (such as DBs or buckets)
-  - Then you should check **if that resource can be exposed or not** (confidential information? vulnerabilities? misconfigurations in the exposed service?)
- **Check permissions**
-  - Here you should **find out all the permissions of each role/user** inside the cloud and how are they used
-    - Too **many highly privileged** (control everything) accounts? Generated keys not used?... Most of these check should have been done in the benchmark tests already
-    - If the client is using OpenID or SAML or other **federation** you might need to ask them for further **information** about **how is being each role assigned** (it's not the same that the admin role is assigned to 1 user or to 100)
-  - It's **not enough to find** which users has **admin** permissions "\*:\*". There are a lot of **other permissions** that depending on the services used can be very **sensitive**.
-    - Moreover, there are **potential privesc** ways to follow abusing permissions. All this things should be taken into account and **as much privesc paths as possible** should be reported.
- **Check Integrations**
-  - It's highly probably that **integrations with other clouds or SaaS** are being used inside the cloud env.
-    - For **integrations of the cloud you are auditing** with other platform you should notify **who has access to (ab)use that integration** and you should ask **how sensitive** is the action being performed.\
-      For example, who can write in an AWS bucket where GCP is getting data from (ask how sensitive is the action in GCP treating that data).
-    - For **integrations inside the cloud you are auditing** from external platforms, you should ask **who has access externally to (ab)use that integration** and check how is that data being used.\
-      For example, if a service is using a Docker image hosted in GCR, you should ask who has access to modify that and which sensitive info and access will get that image when executed inside an AWS cloud.
+- **Provere standarda**
+- Ovo će vam pomoći da **razumete veličinu** okruženja i **usluge koje se koriste**
+- Takođe će vam omogućiti da pronađete neke **brze greške u konfiguraciji** jer većinu ovih testova možete izvršiti pomoću **automatskih alata**
+- **Enumeracija usluga**
+- Verovatno nećete pronaći mnogo više grešaka u konfiguraciji ovde ako ste pravilno izvršili provere standarda, ali mogli biste pronaći neke koje nisu bile tražene u testu standarda.
+- Ovo će vam omogućiti da znate **šta se tačno koristi** u cloud okruženju
+- Ovo će mnogo pomoći u sledećim koracima
+- **Proverite izložene resurse**
+- Ovo se može uraditi tokom prethodne sekcije, potrebno je da **otkrijete sve što je potencijalno izloženo** internetu i kako se može pristupiti.
+- Ovde mislim na **ručno izloženu infrastrukturu** kao što su instance sa web stranicama ili drugi portovi koji su izloženi, kao i na druge **cloud upravljane usluge koje se mogu konfigurisati** da budu izložene (kao što su DB-ovi ili bucket-i)
+- Zatim treba da proverite **da li taj resurs može biti izložen ili ne** (povjerljive informacije? ranjivosti? greške u konfiguraciji izložene usluge?)
+- **Proverite dozvole**
+- Ovde treba da **otkrijete sve dozvole svake uloge/korisnika** unutar clouda i kako se koriste
+- Previše **visoko privilegovanih** (kontrolišu sve) naloga? Generisani ključevi koji se ne koriste?... Većina ovih provera bi već trebala biti izvršena u testovima standarda
+- Ako klijent koristi OpenID ili SAML ili neku drugu **federaciju**, možda ćete morati da ih pitate za dodatne **informacije** o tome **kako se dodeljuju svake uloge** (nije isto da je admin uloga dodeljena 1 korisniku ili 100)
+- **Nije dovoljno pronaći** koji korisnici imaju **admin** dozvole "\*:\*". Postoji mnogo **drugih dozvola** koje, u zavisnosti od korišćenih usluga, mogu biti veoma **osetljive**.
+- Štaviše, postoje **potencijalni putevi za eskalaciju privilegija** koji se mogu iskoristiti zloupotrebom dozvola. Sve ove stvari treba uzeti u obzir i **prijaviti što više puteva za eskalaciju privilegija**.
+- **Proverite integracije**
+- Veoma je verovatno da se **integracije sa drugim cloud-ovima ili SaaS** koriste unutar cloud okruženja.
+- Za **integracije clouda koji audirate** sa drugim platformama, trebate obavestiti **ko ima pristup (zloupotrebu) toj integraciji** i trebate pitati **kako je osetljiva** akcija koja se izvršava.\
+Na primer, ko može da piše u AWS bucket gde GCP dobija podatke (pitajte koliko je osetljiva akcija u GCP-u koja se bavi tim podacima).
+- Za **integracije unutar clouda koji audirate** sa eksternih platformi, trebate pitati **ko ima eksterni pristup (zloupotrebu) toj integraciji** i proveriti kako se ti podaci koriste.\
+Na primer, ako usluga koristi Docker sliku hostovanu u GCR, trebate pitati ko ima pristup da to izmeni i koje osetljive informacije i pristup će ta slika dobiti kada se izvrši unutar AWS clouda.

 ## Multi-Cloud tools

-There are several tools that can be used to test different cloud environments. The installation steps and links are going to be indicated in this section.
+Postoji nekoliko alata koji se mogu koristiti za testiranje različitih cloud okruženja. Koraci instalacije i linkovi biće navedeni u ovoj sekciji.

 ### [PurplePanda](https://github.com/carlospolop/purplepanda)

-A tool to **identify bad configurations and privesc path in clouds and across clouds/SaaS.**
+Alat za **identifikaciju loših konfiguracija i puteva za eskalaciju privilegija u cloud-ovima i između cloud/SaaS.**

 {{#tabs }}
 {{#tab name="Install" }}
-
 ```bash
 # You need to install and run neo4j also
 git clone https://github.com/carlospolop/PurplePanda
@@ -54,29 +53,25 @@ export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
 export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
 python3 main.py -h # Get help
 ```
-
 {{#endtab }}

 {{#tab name="GCP" }}
-
 ```bash
 export GOOGLE_DISCOVERY=$(echo 'google:
 - file_path: ""

 - file_path: ""
-  service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64)
+service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64)

 python3 main.py -a -p google #Get basic info of the account to check it's correctly configured
 python3 main.py -e -p google #Enumerate the env
 ```
-
 {{#endtab }}
 {{#endtabs }}

 ### [Prowler](https://github.com/prowler-cloud/prowler)

-It supports **AWS, GCP & Azure**. Check how to configure each provider in [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws)
-
+Podržava **AWS, GCP i Azure**. Proverite kako da konfigurišete svakog provajdera na [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws)
 ```bash
 # Install
 pip install prowler
@@ -91,14 +86,12 @@ prowler aws --profile custom-profile [-M csv json json-asff html]
 prowler <provider> --list-checks
 prowler <provider> --list-services
 ```
-
 ### [CloudSploit](https://github.com/aquasecurity/cloudsploit)

 AWS, Azure, Github, Google, Oracle, Alibaba

 {{#tabs }}
-{{#tab name="Install" }}
-
+{{#tab name="Instalacija" }}
 ```bash
 # Install
 git clone https://github.com/aquasecurity/cloudsploit.git
@@ -107,16 +100,13 @@ npm install
 ./index.js -h
 ## Docker instructions in github
 ```
-
 {{#endtab }}

 {{#tab name="GCP" }}
-
 ```bash
 ## You need to have creds for a service account and set them in config.js file
 ./index.js --cloud google --config </abs/path/to/config.js>
 ```
-
 {{#endtab }}
 {{#endtabs }}

@@ -125,8 +115,7 @@ npm install
 AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud Infrastructure

 {{#tabs }}
-{{#tab name="Install" }}
-
+{{#tab name="Instalacija" }}
 ```bash
 mkdir scout; cd scout
 virtualenv -p python3 venv
@@ -135,24 +124,21 @@ pip install scoutsuite
 scout --help
 ## Using Docker: https://github.com/nccgroup/ScoutSuite/wiki/Docker-Image
 ```
-
 {{#endtab }}

 {{#tab name="GCP" }}
-
 ```bash
 scout gcp --report-dir /tmp/gcp --user-account --all-projects
 ## use "--service-account KEY_FILE" instead of "--user-account" to use a service account

 SCOUT_FOLDER_REPORT="/tmp"
 for pid in $(gcloud projects list --format="value(projectId)"); do
-    echo "================================================"
-    echo "Checking $pid"
-    mkdir "$SCOUT_FOLDER_REPORT/$pid"
-    scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid"
+echo "================================================"
+echo "Checking $pid"
+mkdir "$SCOUT_FOLDER_REPORT/$pid"
+scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid"
 done
 ```
-
 {{#endtab }}
 {{#endtabs }}

@@ -160,17 +146,14 @@ done

 {{#tabs }}
 {{#tab name="Install" }}
-Download and install Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Or use Brew:
-
+Preuzmite i instalirajte Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Ili koristite Brew:
 ```
 brew tap turbot/tap
 brew install steampipe
 ```
-
 {{#endtab }}

 {{#tab name="GCP" }}
-
 ```bash
 # Install gcp plugin
 steampipe plugin install gcp
@@ -183,13 +166,11 @@ steampipe dashboard
 # To run all the checks from rhe cli
 steampipe check all
 ```
-
 <details>

-<summary>Check all Projects</summary>
-
-In order to check all the projects you need to generate the `gcp.spc` file indicating all the projects to test. You can just follow the indications from the following script
+<summary>Proveri sve projekte</summary>

+Da biste proverili sve projekte, potrebno je da generišete `gcp.spc` datoteku koja označava sve projekte koje treba testirati. Možete jednostavno pratiti uputstva iz sledećeg skripta.
 ```bash
 FILEPATH="/tmp/gcp.spc"
 rm -rf "$FILEPATH" 2>/dev/null
@@ -197,32 +178,30 @@ rm -rf "$FILEPATH" 2>/dev/null
 # Generate a json like object for each project
 for pid in $(gcloud projects list --format="value(projectId)"); do
 echo "connection \"gcp_$(echo -n $pid | tr "-" "_" )\" {
-    plugin  = \"gcp\"
-    project = \"$pid\"
+plugin  = \"gcp\"
+project = \"$pid\"
 }" >> "$FILEPATH"
 done

 # Generate the aggragator to call
 echo 'connection "gcp_all" {
-  plugin      = "gcp"
-  type        = "aggregator"
-  connections = ["gcp_*"]
+plugin      = "gcp"
+type        = "aggregator"
+connections = ["gcp_*"]
 }' >> "$FILEPATH"

 echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generated"
 ```
-
 </details>

-To check **other GCP insights** (useful for enumerating services) use: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
+Da biste proverili **druge GCP uvide** (korisno za enumeraciju usluga) koristite: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)

-To check Terraform GCP code: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance)
+Da biste proverili Terraform GCP kod: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance)

-More GCP plugins of Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
+Više GCP dodataka za Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
 {{#endtab }}

 {{#tab name="AWS" }}
-
 ```bash
 # Install aws plugin
 steampipe plugin install aws
@@ -246,29 +225,27 @@ cd steampipe-mod-aws-compliance
 steampipe dashboard # To see results in browser
 steampipe check all --export=/tmp/output4.json
 ```
+Da biste proverili Terraform AWS kod: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)

-To check Terraform AWS code: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
-
-More AWS plugins of Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
+Više AWS dodataka za Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
 {{#endtab }}
 {{#endtabs }}

 ### [~~cs-suite~~](https://github.com/SecurityFTW/cs-suite)

 AWS, GCP, Azure, DigitalOcean.\
-It requires python2.7 and looks unmaintained.
+Zahteva python2.7 i izgleda da nije održavan.

 ### Nessus

-Nessus has an _**Audit Cloud Infrastructure**_ scan supporting: AWS, Azure, Office 365, Rackspace, Salesforce. Some extra configurations in **Azure** are needed to obtain a **Client Id**.
+Nessus ima _**Audit Cloud Infrastructure**_ skeniranje koje podržava: AWS, Azure, Office 365, Rackspace, Salesforce. Neka dodatna podešavanja u **Azure** su potrebna da bi se dobio **Client Id**.

 ### [**cloudlist**](https://github.com/projectdiscovery/cloudlist)

-Cloudlist is a **multi-cloud tool for getting Assets** (Hostnames, IP Addresses) from Cloud Providers.
+Cloudlist je **multi-cloud alat za dobijanje resursa** (Hostname, IP adrese) od Cloud provajdera.

 {{#tabs }}
 {{#tab name="Cloudlist" }}
-
 ```bash
 cd /tmp
 wget https://github.com/projectdiscovery/cloudlist/releases/latest/download/cloudlist_1.0.1_macOS_arm64.zip
@@ -276,46 +253,40 @@ unzip cloudlist_1.0.1_macOS_arm64.zip
 chmod +x cloudlist
 sudo mv cloudlist /usr/local/bin
 ```
-
 {{#endtab }}

-{{#tab name="Second Tab" }}
-
+{{#tab name="Drugi Tab" }}
 ```bash
 ## For GCP it requires service account JSON credentials
 cloudlist -config </path/to/config>
 ```
-
 {{#endtab }}
 {{#endtabs }}

 ### [**cartography**](https://github.com/lyft/cartography)

-Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database.
+Cartography je Python alat koji konsoliduje infrastrukturne resurse i odnose između njih u intuitivnom grafičkom prikazu koji pokreće Neo4j baza podataka.

 {{#tabs }}
 {{#tab name="Install" }}
-
 ```bash
 # Installation
 docker image pull ghcr.io/lyft/cartography
 docker run --platform linux/amd64 ghcr.io/lyft/cartography cartography --help
 ## Install a Neo4j DB version 3.5.*
 ```
-
 {{#endtab }}

 {{#tab name="GCP" }}
-
 ```bash
 docker run --platform linux/amd64 \
-     --volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \
-     -e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \
-     -e NEO4j_PASSWORD="s3cr3t" \
-     ghcr.io/lyft/cartography  \
-     --neo4j-uri bolt://host.docker.internal:7687 \
-     --neo4j-password-env-var NEO4j_PASSWORD \
-     --neo4j-user neo4j
+--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \
+-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \
+-e NEO4j_PASSWORD="s3cr3t" \
+ghcr.io/lyft/cartography  \
+--neo4j-uri bolt://host.docker.internal:7687 \
+--neo4j-password-env-var NEO4j_PASSWORD \
+--neo4j-user neo4j


 # It only checks for a few services inside GCP (https://lyft.github.io/cartography/modules/gcp/index.html)
@@ -326,17 +297,15 @@ docker run --platform linux/amd64 \
 ## Google Kubernetes Engine
 ### If you can run starbase or purplepanda you will get more info
 ```
-
 {{#endtab }}
 {{#endtabs }}

 ### [**starbase**](https://github.com/JupiterOne/starbase)

-Starbase collects assets and relationships from services and systems including cloud infrastructure, SaaS applications, security controls, and more into an intuitive graph view backed by the Neo4j database.
+Starbase prikuplja resurse i odnose iz usluga i sistema uključujući cloud infrastrukturu, SaaS aplikacije, bezbednosne kontrole i još mnogo toga u intuitivnom grafičkom prikazu podržanom Neo4j bazom podataka.

 {{#tabs }}
 {{#tab name="Install" }}
-
 ```bash
 # You are going to need Node version 14, so install nvm following https://tecadmin.net/install-nvm-macos-with-homebrew/
 npm install --global yarn
@@ -359,44 +328,40 @@ docker build --no-cache -t starbase:latest .
 docker-compose run starbase setup
 docker-compose run starbase run
 ```
-
 {{#endtab }}

 {{#tab name="GCP" }}
-
 ```yaml
 ## Config for GCP
 ### Check out: https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md
 ### It requires service account credentials

 integrations:
-  - name: graph-google-cloud
-    instanceId: testInstanceId
-    directory: ./.integrations/graph-google-cloud
-    gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
-    config:
-      SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}"
-      PROJECT_ID: ""
-      FOLDER_ID: ""
-      ORGANIZATION_ID: ""
-      CONFIGURE_ORGANIZATION_PROJECTS: false
+- name: graph-google-cloud
+instanceId: testInstanceId
+directory: ./.integrations/graph-google-cloud
+gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
+config:
+SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}"
+PROJECT_ID: ""
+FOLDER_ID: ""
+ORGANIZATION_ID: ""
+CONFIGURE_ORGANIZATION_PROJECTS: false

 storage:
-  engine: neo4j
-  config:
-    username: neo4j
-    password: s3cr3t
-    uri: bolt://localhost:7687
-    #Consider using host.docker.internal if from docker
+engine: neo4j
+config:
+username: neo4j
+password: s3cr3t
+uri: bolt://localhost:7687
+#Consider using host.docker.internal if from docker
 ```
-
 {{#endtab }}
 {{#endtabs }}

 ### [**SkyArk**](https://github.com/cyberark/SkyArk)

-Discover the most privileged users in the scanned AWS or Azure environment, including the AWS Shadow Admins. It uses powershell.
-
+Otkrivanje najprivilegovanijih korisnika u skeniranoj AWS ili Azure sredini, uključujući AWS Shadow Admins. Koristi powershell.
 ```powershell
 Import-Module .\SkyArk.ps1 -force
 Start-AzureStealth
@@ -405,18 +370,17 @@ Start-AzureStealth
 IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1')
 Scan-AzureAdmins
 ```
-
 ### [Cloud Brute](https://github.com/0xsha/CloudBrute)

-A tool to find a company (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
+Alat za pronalaženje infrastrukture, fajlova i aplikacija kompanije (meta) na vodećim cloud provajderima (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).

 ### [CloudFox](https://github.com/BishopFox/cloudfox)

- CloudFox is a tool to find exploitable attack paths in cloud infrastructure (currently only AWS & Azure supported with GCP upcoming).
- It is an enumeration tool which is intended to compliment manual pentesting.
- It doesn't create or modify any data within the cloud environment.
+- CloudFox je alat za pronalaženje iskoristivih puteva napada u cloud infrastrukturi (trenutno podržani samo AWS i Azure, GCP dolazi uskoro).
+- To je alat za enumeraciju koji je namenjen da dopuni manuelni pentesting.
+- Ne kreira niti menja bilo kakve podatke unutar cloud okruženja.

-### More lists of cloud security tools
+### Više lista alata za cloud bezbednost

 - [https://github.com/RyanJarv/awesome-cloud-sec](https://github.com/RyanJarv/awesome-cloud-sec)

@@ -448,14 +412,10 @@ azure-security/

 ### Attack Graph

-[**Stormspotter** ](https://github.com/Azure/Stormspotter)creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work.
+[**Stormspotter** ](https://github.com/Azure/Stormspotter) kreira “graf napada” resursa u Azure pretplati. Omogućava red timovima i pentesterima da vizualizuju površinu napada i mogućnosti prebacivanja unutar zakupca, i pojačava vaše branioca da brzo orijentišu i prioritizuju rad na odgovoru na incidente.

 ### Office365

-You need **Global Admin** or at least **Global Admin Reader** (but note that Global Admin Reader is a little bit limited). However, those limitations appear in some PS modules and can be bypassed accessing the features **via the web application**.
+Potrebni su vam **Global Admin** ili barem **Global Admin Reader** (ali imajte na umu da je Global Admin Reader malo ograničen). Međutim, ta ograničenja se pojavljuju u nekim PS modulima i mogu se zaobići pristupanjem funkcijama **putem web aplikacije**.

 {{#include ../banners/hacktricks-training.md}}
-
-
-
-