Migrate to using mdbook

src/pentesting-ci-cd/cloudflare-security/README.md

@@ -0,0 +1,134 @@
+# Cloudflare Security
+
+{{#include ../../banners/hacktricks-training.md}}
+
+In a Cloudflare account there are some **general settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:**
+
+<figure><img src="../../images/image (117).png" alt=""><figcaption></figcaption></figure>
+
+## Websites
+
+Review each with:
+
+{{#ref}}
+cloudflare-domains.md
+{{#endref}}
+
+### Domain Registration
+
+- [ ] In **`Transfer Domains`** check that it's not possible to transfer any domain.
+
+Review each with:
+
+{{#ref}}
+cloudflare-domains.md
+{{#endref}}
+
+## Analytics
+
+_I couldn't find anything to check for a config security review._
+
+## Pages
+
+On each Cloudflare's page:
+
+- [ ] Check for **sensitive information** in the **`Build log`**.
+- [ ] Check for **sensitive information** in the **Github repository** assigned to the pages.
+- [ ] Check for potential github repo compromise via **workflow command injection** or `pull_request_target` compromise. More info in the [**Github Security page**](../github-security/).
+- [ ] Check for **vulnerable functions** in the `/fuctions` directory (if any), check the **redirects** in the `_redirects` file (if any) and **misconfigured headers** in the `_headers` file (if any).
+- [ ] Check for **vulnerabilities** in the **web page** via **blackbox** or **whitebox** if you can **access the code**
+- [ ] In the details of each page `/<page_id>/pages/view/blocklist/settings/functions`. Check for **sensitive information** in the **`Environment variables`**.
+- [ ] In the details page check also the **build command** and **root directory** for **potential injections** to compromise the page.
+
+## **Workers**
+
+On each Cloudflare's worker check:
+
+- [ ] The triggers: What makes the worker trigger? Can a **user send data** that will be **used** by the worker?
+- [ ] In the **`Settings`**, check for **`Variables`** containing **sensitive information**
+- [ ] Check the **code of the worker** and search for **vulnerabilities** (specially in places where the user can manage the input)
+  - Check for SSRFs returning the indicated page that you can control
+  - Check XSSs executing JS inside a svg image
+  - It is possible that the worker interacts with other internal services. For example, a worker may interact with a R2 bucket storing information in it obtained from the input. In that case, it would be necessary to check what capabilities does the worker have over the R2 bucket and how could it be abused from the user input.
+
+> [!WARNING]
+> Note that by default a **Worker is given a URL** such as `<worker-name>.<account>.workers.dev`. The user can set it to a **subdomain** but you can always access it with that **original URL** if you know it.
+
+## R2
+
+On each R2 bucket check:
+
+- [ ] Configure **CORS Policy**.
+
+## Stream
+
+TODO
+
+## Images
+
+TODO
+
+## Security Center
+
+- [ ] If possible, run a **`Security Insights`** **scan** and an **`Infrastructure`** **scan**, as they will **highlight** interesting information **security** wise.
+- [ ] Just **check this information** for security misconfigurations and interesting info
+
+## Turnstile
+
+TODO
+
+## **Zero Trust**
+
+{{#ref}}
+cloudflare-zero-trust-network.md
+{{#endref}}
+
+## Bulk Redirects
+
+> [!NOTE]
+> Unlike [Dynamic Redirects](https://developers.cloudflare.com/rules/url-forwarding/dynamic-redirects/), [**Bulk Redirects**](https://developers.cloudflare.com/rules/url-forwarding/bulk-redirects/) are essentially static — they do **not support any string replacement** operations or regular expressions. However, you can configure URL redirect parameters that affect their URL matching behavior and their runtime behavior.
+
+- [ ] Check that the **expressions** and **requirements** for redirects **make sense**.
+- [ ] Check also for **sensitive hidden endpoints** that you contain interesting info.
+
+## Notifications
+
+- [ ] Check the **notifications.** These notifications are recommended for security:
+  - `Usage Based Billing`
+  - `HTTP DDoS Attack Alert`
+  - `Layer 3/4 DDoS Attack Alert`
+  - `Advanced HTTP DDoS Attack Alert`
+  - `Advanced Layer 3/4 DDoS Attack Alert`
+  - `Flow-based Monitoring: Volumetric Attack`
+  - `Route Leak Detection Alert`
+  - `Access mTLS Certificate Expiration Alert`
+  - `SSL for SaaS Custom Hostnames Alert`
+  - `Universal SSL Alert`
+  - `Script Monitor New Code Change Detection Alert`
+  - `Script Monitor New Domain Alert`
+  - `Script Monitor New Malicious Domain Alert`
+  - `Script Monitor New Malicious Script Alert`
+  - `Script Monitor New Malicious URL Alert`
+  - `Script Monitor New Scripts Alert`
+  - `Script Monitor New Script Exceeds Max URL Length Alert`
+  - `Advanced Security Events Alert`
+  - `Security Events Alert`
+- [ ] Check all the **destinations**, as there could be **sensitive info** (basic http auth) in webhook urls. Make also sure webhook urls use **HTTPS**
+  - [ ] As extra check, you could try to **impersonate a cloudflare notification** to a third party, maybe you can somehow **inject something dangerous**
+
+## Manage Account
+
+- [ ] It's possible to see the **last 4 digits of the credit card**, **expiration** time and **billing address** in **`Billing` -> `Payment info`**.
+- [ ] It's possible to see the **plan type** used in the account in **`Billing` -> `Subscriptions`**.
+- [ ] In **`Members`** it's possible to see all the members of the account and their **role**. Note that if the plan type isn't Enterprise, only 2 roles exist: Administrator and Super Administrator. But if the used **plan is Enterprise**, [**more roles**](https://developers.cloudflare.com/fundamentals/account-and-billing/account-setup/account-roles/) can be used to follow the least privilege principle.
+  - Therefore, whenever possible is **recommended** to use the **Enterprise plan**.
+- [ ] In Members it's possible to check which **members** has **2FA enabled**. **Every** user should have it enabled.
+
+> [!NOTE]
+> Note that fortunately the role **`Administrator`** doesn't give permissions to manage memberships (**cannot escalate privs or invite** new members)
+
+## DDoS Investigation
+
+[Check this part](cloudflare-domains.md#cloudflare-ddos-protection).
+
+{{#include ../../banners/hacktricks-training.md}}

src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md

@@ -0,0 +1,133 @@
+# Cloudflare Domains
+
+{{#include ../../banners/hacktricks-training.md}}
+
+In each TLD configured in Cloudflare there are some **general settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:**
+
+<figure><img src="../../images/image (101).png" alt=""><figcaption></figcaption></figure>
+
+### Overview
+
+- [ ] Get a feeling of **how much** are the services of the account **used**
+- [ ] Find also the **zone ID** and the **account ID**
+
+### Analytics
+
+- [ ] In **`Security`** check if there is any **Rate limiting**
+
+### DNS
+
+- [ ] Check **interesting** (sensitive?) data in DNS **records**
+- [ ] Check for **subdomains** that could contain **sensitive info** just based on the **name** (like admin173865324.domin.com)
+- [ ] Check for web pages that **aren't** **proxied**
+- [ ] Check for **proxified web pages** that can be **accessed directly** by CNAME or IP address
+- [ ] Check that **DNSSEC** is **enabled**
+- [ ] Check that **CNAME Flattening** is **used** in **all CNAMEs**
+  - This is could be useful to **hide subdomain takeover vulnerabilities** and improve load timings
+- [ ] Check that the domains [**aren't vulnerable to spoofing**](https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp#mail-spoofing)
+
+### **Email**
+
+TODO
+
+### Spectrum
+
+TODO
+
+### SSL/TLS
+
+#### **Overview**
+
+- [ ] The **SSL/TLS encryption** should be **Full** or **Full (Strict)**. Any other will send **clear-text traffic** at some point.
+- [ ] The **SSL/TLS Recommender** should be enabled
+
+#### Edge Certificates
+
+- [ ] **Always Use HTTPS** should be **enabled**
+- [ ] **HTTP Strict Transport Security (HSTS)** should be **enabled**
+- [ ] **Minimum TLS Version should be 1.2**
+- [ ] **TLS 1.3 should be enabled**
+- [ ] **Automatic HTTPS Rewrites** should be **enabled**
+- [ ] **Certificate Transparency Monitoring** should be **enabled**
+
+### **Security**
+
+- [ ] In the **`WAF`** section it's interesting to check that **Firewall** and **rate limiting rules are used** to prevent abuses.
+  - The **`Bypass`** action will **disable Cloudflare security** features for a request. It shouldn't be used.
+- [ ] In the **`Page Shield`** section it's recommended to check that it's **enabled** if any page is used
+- [ ] In the **`API Shield`** section it's recommended to check that it's **enabled** if any API is exposed in Cloudflare
+- [ ] In the **`DDoS`** section it's recommended to enable the **DDoS protections**
+- [ ] In the **`Settings`** section:
+  - [ ] Check that the **`Security Level`** is **medium** or greater
+  - [ ] Check that the **`Challenge Passage`** is 1 hour at max
+  - [ ] Check that the **`Browser Integrity Check`** is **enabled**
+  - [ ] Check that the **`Privacy Pass Support`** is **enabled**
+
+#### **CloudFlare DDoS Protection**
+
+- If you can, enable **Bot Fight Mode** or **Super Bot Fight Mode**. If you protecting some API accessed programmatically (from a JS front end page for example). You might not be able to enable this without breaking that access.
+- In **WAF**: You can create **rate limits by URL path** or to **verified bots** (Rate limiting rules), or to **block access** based on IP, Cookie, referrer...). So you could block requests that doesn't come from a web page or has a cookie.
+  - If the attack is from a **verified bot**, at least **add a rate limit** to bots.
+  - If the attack is to a **specific path**, as prevention mechanism, add a **rate limit** in this path.
+  - You can also **whitelist** IP addresses, IP ranges, countries or ASNs from the **Tools** in WAF.
+  - Check if **Managed rules** could also help to prevent vulnerability exploitations.
+  - In the **Tools** section you can **block or give a challenge to specific IPs** and **user agents.**
+- In DDoS you could **override some rules to make them more restrictive**.
+- **Settings**: Set **Security Level** to **High** and to **Under Attack** if you are Under Attack and that the **Browser Integrity Check is enabled**.
+- In Cloudflare Domains -> Analytics -> Security -> Check if **rate limit** is enabled
+- In Cloudflare Domains -> Security -> Events -> Check for **detected malicious Events**
+
+### Access
+
+{{#ref}}
+cloudflare-zero-trust-network.md
+{{#endref}}
+
+### Speed
+
+_I couldn't find any option related to security_
+
+### Caching
+
+- [ ] In the **`Configuration`** section consider enabling the **CSAM Scanning Tool**
+
+### **Workers Routes**
+
+_You should have already checked_ [_cloudflare workers_](./#workers)
+
+### Rules
+
+TODO
+
+### Network
+
+- [ ] If **`HTTP/2`** is **enabled**, **`HTTP/2 to Origin`** should be **enabled**
+- [ ] **`HTTP/3 (with QUIC)`** should be **enabled**
+- [ ] If the **privacy** of your **users** is important, make sure **`Onion Routing`** is **enabled**
+
+### **Traffic**
+
+TODO
+
+### Custom Pages
+
+- [ ] It's optional to configure custom pages when an error related to security is triggered (like a block, rate limiting or I'm under attack mode)
+
+### Apps
+
+TODO
+
+### Scrape Shield
+
+- [ ] Check **Email Address Obfuscation** is **enabled**
+- [ ] Check **Server-side Excludes** is **enabled**
+
+### **Zaraz**
+
+TODO
+
+### **Web3**
+
+TODO
+
+{{#include ../../banners/hacktricks-training.md}}

src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md

@@ -0,0 +1,61 @@
+# Cloudflare Zero Trust Network
+
+{{#include ../../banners/hacktricks-training.md}}
+
+In a **Cloudflare Zero Trust Network** account there are some **settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:**
+
+<figure><img src="../../images/image (206).png" alt=""><figcaption></figcaption></figure>
+
+### Analytics
+
+- [ ] Useful to **get to know the environment**
+
+### **Gateway**
+
+- [ ] In **`Policies`** it's possible to generate policies to **restrict** by **DNS**, **network** or **HTTP** request who can access applications.
+  - If used, **policies** could be created to **restrict** the access to malicious sites.
+  - This is **only relevant if a gateway is being used**, if not, there is no reason to create defensive policies.
+
+### Access
+
+#### Applications
+
+On each application:
+
+- [ ] Check **who** can access to the application in the **Policies** and check that **only** the **users** that **need access** to the application can access.
+  - To allow access **`Access Groups`** are going to be used (and **additional rules** can be set also)
+- [ ] Check the **available identity providers** and make sure they **aren't too open**
+- [ ] In **`Settings`**:
+  - [ ] Check **CORS isn't enabled** (if it's enabled, check it's **secure** and it isn't allowing everything)
+  - [ ] Cookies should have **Strict Same-Site** attribute, **HTTP Only** and **binding cookie** should be **enabled** if the application is HTTP.
+  - [ ] Consider enabling also **Browser rendering** for better **protection. More info about** [**remote browser isolation here**](https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/)**.**
+
+#### **Access Groups**
+
+- [ ] Check that the access groups generated are **correctly restricted** to the users they should allow.
+- [ ] It's specially important to check that the **default access group isn't very open** (it's **not allowing too many people**) as by **default** anyone in that **group** is going to be able to **access applications**.
+  - Note that it's possible to give **access** to **EVERYONE** and other **very open policies** that aren't recommended unless 100% necessary.
+
+#### Service Auth
+
+- [ ] Check that all service tokens **expires in 1 year or less**
+
+#### Tunnels
+
+TODO
+
+### My Team
+
+TODO
+
+### Logs
+
+- [ ] You could search for **unexpected actions** from users
+
+### Settings
+
+- [ ] Check the **plan type**
+- [ ] It's possible to see the **credits card owner name**, **last 4 digits**, **expiration** date and **address**
+- [ ] It's recommended to **add a User Seat Expiration** to remove users that doesn't really use this service
+
+{{#include ../../banners/hacktricks-training.md}}