trasnlate other half

src/README.md

@@ -38,3 +38,5 @@ _Hacktricks logos & motion designed by_ [_@ppiernacho_](https://www.instagram.co
 
 
 
+
+

src/SUMMARY.md

@@ -505,3 +505,5 @@
 
 
 
+
+

src/banners/hacktricks-training.md

@@ -15,3 +15,5 @@
 
 
 
+
+

src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md

@@ -141,3 +141,4 @@ From a **white box security** review, you would need the **System Auditor role**
 
 
 
+

src/pentesting-ci-cd/apache-airflow-security/README.md

@@ -177,3 +177,4 @@ If they are used for example inside a a bash command, you could perform a comman
 
 
 
+

src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md

@@ -113,3 +113,4 @@ AUTH_ROLE_PUBLIC = 'Admin'
 
 
 
+

src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md

@@ -45,3 +45,4 @@ These are the default permissions per default role:
 
 
 
+

src/pentesting-ci-cd/atlantis-security.md

@@ -390,3 +390,4 @@ You can also pass these as environment variables `ATLANTIS_WEB_BASIC_AUTH=true`
 
 
 
+

src/pentesting-ci-cd/circleci-security.md

@@ -257,3 +257,4 @@ jobs:
 
 
 
+

src/pentesting-ci-cd/cloudflare-security/README.md

@@ -136,3 +136,4 @@ cloudflare-zero-trust-network.md
 
 
 
+

src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md

@@ -135,3 +135,4 @@ TODO
 
 
 
+

src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md

@@ -63,3 +63,4 @@ TODO
 
 
 
+

src/pentesting-ci-cd/concourse-security/README.md

@@ -35,3 +35,4 @@ concourse-enumeration-and-attacks.md
 
 
 
+

src/pentesting-ci-cd/concourse-security/concourse-architecture.md

@@ -40,3 +40,4 @@ In order to execute tasks concourse must have some workers. These workers **regi
 
 
 
+

src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md

@@ -444,3 +444,4 @@ Accept-Encoding: gzip.
 
 
 
+

src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md

@@ -153,3 +153,4 @@ Check a YAML pipeline example that triggers on new commits to master in [https:/
 
 
 
+

src/pentesting-ci-cd/gitea-security/README.md

@@ -140,3 +140,4 @@ If you are inside the server you can also **use the `gitea` binary** to access/m
 
 
 
+

src/pentesting-ci-cd/gitea-security/basic-gitea-information.md

@@ -105,3 +105,4 @@ Different protections can be applied to a branch (like to master):
 
 
 
+

src/pentesting-ci-cd/github-security/README.md

@@ -246,3 +246,4 @@ For more info check [https://www.chainguard.dev/unchained/what-the-fork-imposter
 
 
 
+

src/pentesting-ci-cd/github-security/abusing-github-actions/README.md

@@ -583,3 +583,4 @@ The following tools are useful to find Github Action workflows and even find vul
 
 
 
+

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md

@@ -4,3 +4,4 @@
 
 
 
+

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md

@@ -4,3 +4,4 @@
 
 
 
+

src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md

@@ -4,3 +4,4 @@
 
 
 
+

src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md

@@ -58,3 +58,4 @@ And the latest one use a short sha-1 that is bruteforceable.
 
 
 
+

src/pentesting-ci-cd/github-security/basic-github-information.md

@@ -257,3 +257,4 @@ Different protections can be applied to a branch (like to master):
 
 
 
+

src/pentesting-ci-cd/jenkins-security/README.md

@@ -414,3 +414,4 @@ println(hudson.util.Secret.decrypt("{...}"))
 
 
 
+

src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md

@@ -96,3 +96,4 @@ According to [**the docs**](https://www.jenkins.io/blog/2019/02/21/credentials-m
 
 
 
+

src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md

@@ -107,3 +107,4 @@ The example curl command provided demonstrates how to make a request to Jenkins
 
 
 
+

src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md

@@ -91,3 +91,4 @@ for (c in creds) {
 
 
 
+

src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md

@@ -41,3 +41,4 @@ If you can access the configuration file of some pipeline configured you could j
 
 
 
+

src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md

@@ -38,3 +38,4 @@ If you are not executing a reverse shell but a simple command you can **see the
 
 
 
+

src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md

@@ -65,3 +65,4 @@ msf> use exploit/multi/http/jenkins_script_console
 
 
 
+

src/pentesting-ci-cd/okta-security/README.md

@@ -116,3 +116,4 @@ okta-hardening.md
 
 
 
+

src/pentesting-ci-cd/okta-security/okta-hardening.md

@@ -201,3 +201,4 @@ Here you can download Okta agents to sync Okta with other technologies.
 
 
 
+

src/pentesting-ci-cd/pentesting-ci-cd-methodology.md

@@ -106,3 +106,4 @@ Check this interesting article about the top 10 CI/CD risks according to Cider:
 
 
 
+

src/pentesting-ci-cd/serverless.com-security.md

@@ -860,3 +860,4 @@ Granting excessive permissions to team members and external collaborators can le
 
 
 
+

src/pentesting-ci-cd/supabase-security.md

@@ -165,3 +165,4 @@ It's possible to **store secrets** in supabase also which will be **accessible b
 
 
 
+

src/pentesting-ci-cd/terraform-security.md

@@ -314,3 +314,4 @@ brew install terrascan
 
 
 
+

src/pentesting-ci-cd/todo.md

@@ -18,3 +18,4 @@ Github PRs are welcome explaining how to (ab)use those platforms from an attacke
 
 
 
+

src/pentesting-ci-cd/travisci-security/README.md

@@ -67,3 +67,4 @@ If an attacker ends in an environment which uses **TravisCI enterprise** (more i
 
 
 
+

src/pentesting-ci-cd/travisci-security/basic-travisci-information.md

@@ -94,3 +94,4 @@ The amount of deployed TCI Worker and build environment OS images will determine
 
 
 
+

src/pentesting-ci-cd/vercel-security.md

@@ -439,3 +439,4 @@ An **Access Group** in Vercel is a collection of projects and team members with
 
 
 
+

src/pentesting-cloud/aws-security/README.md

@@ -391,3 +391,5 @@ aws ...
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-basic-information/README.md

@@ -388,3 +388,5 @@ If you are looking for something **similar** to this but for the **browser** you
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md

@@ -131,3 +131,5 @@ In order to specify **which service account should be able to assume the role,**
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md

@@ -19,3 +19,5 @@ These are the permissions you need on each AWS account you want to audit to be a
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/README.md

@@ -4,3 +4,5 @@
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md

@@ -34,3 +34,5 @@ Or just remove the use of API keys.
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md

@@ -44,3 +44,5 @@ By default this is disabled:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md

@@ -65,3 +65,5 @@ The compromised instances or Lambda functions can periodically check the C2 tabl
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md

@@ -56,3 +56,5 @@ Create a peering connection between the victim VPC and the attacker VPC so he wi
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md

@@ -99,3 +99,5 @@ aws ecr put-replication-configuration \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

@@ -101,3 +101,5 @@ aws ecs create-service --service-name "undocumented-service" --task-definition "
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md

@@ -23,3 +23,5 @@ You could **create an access point** (with root access to `/`) accessible from a
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md

@@ -79,3 +79,5 @@ aws elasticbeanstalk update-environment --environment-name my-env --option-setti
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md

@@ -51,3 +51,5 @@ If the account is already trusting a common identity provider (such as Github) t
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -41,3 +41,5 @@ aws kms list-grants --key-id <key-id>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md

@@ -66,3 +66,5 @@ Here you have some ideas to make your **presence in AWS more stealth by creating
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md

@@ -44,3 +44,5 @@ The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md

@@ -132,3 +132,5 @@ aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --state
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md

@@ -35,3 +35,5 @@ If domains are configured:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md

@@ -33,3 +33,5 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md

@@ -27,3 +27,5 @@ Although usually ACLs of buckets are disabled, an attacker with enough privilege
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md

@@ -55,3 +55,5 @@ def generate_password():
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -83,3 +83,5 @@ aws sns subscribe --region <region> \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md

@@ -41,3 +41,5 @@ The following policy gives everyone in AWS access to everything in the queue cal
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md

@@ -4,3 +4,5 @@
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md

@@ -23,3 +23,5 @@ If the AWS account is using aliases to call step functions it would be possible
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md

@@ -133,3 +133,5 @@ Write-Host "Role juggling check complete."
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/README.md

@@ -4,3 +4,5 @@
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md

@@ -148,3 +148,5 @@ aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_K
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md

@@ -33,3 +33,5 @@ You can check the [**tf code to recreate this scenarios here**](https://github.c
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md

@@ -86,3 +86,5 @@ aws codebuild delete-source-credentials --arn <value>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md

@@ -190,3 +190,5 @@ aws codebuild start-build --project-name <proj-name>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md

@@ -22,3 +22,5 @@ aws controltower enable-control --control-identifier <arn_control_id> --target-i
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md

@@ -97,3 +97,5 @@ A template for the policy document can be seen here:
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md

@@ -351,3 +351,5 @@ bashCopy codeaws dynamodbstreams get-records \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -479,3 +479,5 @@ if __name__ == "__main__":
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md

@@ -143,3 +143,5 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md

@@ -17,3 +17,5 @@ For more information and access to the [**malmirror script**](https://github.com
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md

@@ -98,3 +98,5 @@ aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-i
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md

@@ -65,3 +65,5 @@ The EC2 instance will probably also have the permission `ecr:GetAuthorizationTok
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md

@@ -56,3 +56,5 @@ aws efs delete-access-point --access-point-id <value>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md

@@ -157,3 +157,5 @@ So, if an **attacker compromises a cluster using fargate** and **removes all the
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md

@@ -82,3 +82,5 @@ aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md

@@ -105,3 +105,5 @@ A common way to avoid Confused Deputy problems is the use of a condition with `A
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md

@@ -135,3 +135,5 @@ aws kms schedule-key-deletion \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md

@@ -31,3 +31,5 @@ Abusing Lambda Layers it's also possible to abuse extensions and persist in the
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md

@@ -65,3 +65,5 @@ For more info check [https://github.com/carlospolop/lambda_bootstrap_switcher](h
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md

@@ -32,3 +32,5 @@ Check out the Lightsail privesc options to learn different ways to access potent
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation.md

@@ -21,3 +21,5 @@ aws organizations deregister-account --account-id <account_id> --region <region>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md

@@ -94,3 +94,5 @@ aws rds start-export-task --export-task-identifier attacker-export-task --source
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md

@@ -40,3 +40,5 @@ Finally, the attacker could upload a final file, usually named "ransom-note.txt,
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -51,3 +51,5 @@ aws secretsmanager delete-secret \
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md

@@ -85,3 +85,5 @@ Still to test.
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md

@@ -82,3 +82,5 @@ aws sns untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md

@@ -89,3 +89,5 @@ arduinoCopy codeaws sqs remove-permission --queue-url <value> --label <value>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md

@@ -27,3 +27,5 @@ aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md

@@ -76,3 +76,5 @@ aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
 
 
 
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md

@@ -106,3 +106,5 @@ response = client.get_secret_value(SecretId="flag_secret") print(response['Secre
 
 
 
+
+