Offensive security assessments
GCP
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- Identify and enumerate GCP resources and assets. - Utilize GCP-native tools or APIs for asset discovery. - Tools: Google Cloud Console, Google Cloud SDK, Asset Inventory - Enumerate DNS records for GCP-related domains. - Identify public-facing services and subdomains. - Tools: DNS Enumeration Tools (e.g., dig, nslookup)
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Review IAM policies and roles for GCP resources.
- Identify overly permissive permissions and misconfigurations.
- Tools: Google Cloud Console, gcloud command-line tool
- Assess VPC configurations, subnets, and firewall rules.
- Check for exposed external IPs and unprotected services.
- Perform automated vulnerability scanning using GCP-native or third-party tools.
- Identify vulnerabilities specific to GCP services.
- Tools: Google Cloud Security Scanner, Third-party Scanners
What we look for
- Review IAM policies and roles for GCP resources.
- Identify overly permissive permissions and misconfigurations.
- Tools: Google Cloud Console, gcloud command-line tool
- Assess VPC configurations, subnets, and firewall rules.
- Check for exposed external IPs and unprotected services.
- Perform automated vulnerability scanning using GCP-native or third-party tools.
- Identify vulnerabilities specific to GCP services.
- Tools: Google Cloud Security Scanner, Third-party Scanners
Related topics
| Topic | Summary |
|---|---|
| AWS | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| Azure | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| Subdomain Takeover | A subdomain takeover happens when a DNS record (usually a CNAME, sometimes A/NS) still points to a cloud service or external provider that is no longer claimed. An attacker registers the dangling resource on that provider and serves their own content from the victim's subdomain,… |