Migrate to using mdbook

src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md

@@ -0,0 +1,61 @@
+# Cloudflare Zero Trust Network
+
+{{#include ../../banners/hacktricks-training.md}}
+
+In a **Cloudflare Zero Trust Network** account there are some **settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:**
+
+<figure><img src="../../images/image (206).png" alt=""><figcaption></figcaption></figure>
+
+### Analytics
+
+- [ ] Useful to **get to know the environment**
+
+### **Gateway**
+
+- [ ] In **`Policies`** it's possible to generate policies to **restrict** by **DNS**, **network** or **HTTP** request who can access applications.
+  - If used, **policies** could be created to **restrict** the access to malicious sites.
+  - This is **only relevant if a gateway is being used**, if not, there is no reason to create defensive policies.
+
+### Access
+
+#### Applications
+
+On each application:
+
+- [ ] Check **who** can access to the application in the **Policies** and check that **only** the **users** that **need access** to the application can access.
+  - To allow access **`Access Groups`** are going to be used (and **additional rules** can be set also)
+- [ ] Check the **available identity providers** and make sure they **aren't too open**
+- [ ] In **`Settings`**:
+  - [ ] Check **CORS isn't enabled** (if it's enabled, check it's **secure** and it isn't allowing everything)
+  - [ ] Cookies should have **Strict Same-Site** attribute, **HTTP Only** and **binding cookie** should be **enabled** if the application is HTTP.
+  - [ ] Consider enabling also **Browser rendering** for better **protection. More info about** [**remote browser isolation here**](https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/)**.**
+
+#### **Access Groups**
+
+- [ ] Check that the access groups generated are **correctly restricted** to the users they should allow.
+- [ ] It's specially important to check that the **default access group isn't very open** (it's **not allowing too many people**) as by **default** anyone in that **group** is going to be able to **access applications**.
+  - Note that it's possible to give **access** to **EVERYONE** and other **very open policies** that aren't recommended unless 100% necessary.
+
+#### Service Auth
+
+- [ ] Check that all service tokens **expires in 1 year or less**
+
+#### Tunnels
+
+TODO
+
+### My Team
+
+TODO
+
+### Logs
+
+- [ ] You could search for **unexpected actions** from users
+
+### Settings
+
+- [ ] Check the **plan type**
+- [ ] It's possible to see the **credits card owner name**, **last 4 digits**, **expiration** date and **address**
+- [ ] It's recommended to **add a User Seat Expiration** to remove users that doesn't really use this service
+
+{{#include ../../banners/hacktricks-training.md}}