> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/cloud/gcp.md). # GCP

## Initial Access {% embed url="" %} ## Google Search {% content-ref url="/pages/fVeFtPSAWQuWG0C5room" %} [Cloud](/0xss0rz/pentest/recon/cloud.md) {% endcontent-ref %} ## Misconfiguration {% embed url="" %} ## CLI Recon ### Projects IDs of projects available in account ``` gcloud projects list --format="table(projectId)" ``` ### Buckets List the identifier of each storage bucket created for the project ``` gsutil ls -p ``` IAM members associated with the bucket - "`allUsers` or "`allAuthenticatedUser`s", the bucket is publicly available ``` gsutil iam get gs:/// --format=json | jq '.bindings[].members[]' ``` ### BigQuery List the identifier of each BigQuery Dataset created for the project ``` bq ls --project_id --format=pretty ``` If one or more rules are "`allUsers` or `"allAuthenticatedUsers`", the dataset is publicly available ``` bq show --format=pretty : ``` ### VM Instances List all the VM available for the project ``` gcloud compute images list --project --no-standard-images --format="table(name)" ``` IAM members associated with the VM - "`allAuthenticatedUsers`", the VM is publicly shared with all others GCP accounts ``` gcloud compute images get-iam-policy --format=json ``` Creat new image ``` gcloud compute images create --source-image= --source-image-project= ``` View image ``` gcloud compute images list ``` ### KMS List the IDs of all the KMS key rings available in account ``` gcloud kms keyrings list --location=global ``` List the resource ID of each KMS key created for the key ring ``` gcloud kms key list --keyring= --location=global --format="table(name) ``` "`allUsers` or "`allAuthenticatedUsers`", the KMS key is publicly available ``` gcloud kms keys get-iam-policy --keyring= --location=global --format=json | jq '.bindings[].members[]' ``` ### SQL DB Name of each SQL DB for the project ``` gcloud sql instances list --project --format="(NAME)" ``` IAM members associated - `0.0.0.0/0` : DB is publicly accessible ``` gcloud sql instances describe --format=json | jq '.settings.ipConfiguration.authorizedNetworks[].value' ``` ## Resources {% embed url="" %} {% embed url="" %}