Cloudflare Zero Trust Network
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
In a Cloudflare Zero Trust Network account there are some settings and services that can be configured. In this page we are going to analyze the security related settings of each section:
![](https://cloud.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F430239558-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F5uvPQhxNCPYYTqpRwsuS%252Fuploads%252FyCqa8hgQKxkQhc3Rtlny%252Fimage.png%3Falt%3Dmedia%26token%3D9807f95c-6932-4d92-beeb-e6b3deb1809e&width=768&dpr=4&quality=100&sign=c8cab86c&sv=1)
Analytics
Gateway
Access
Applications
On each application:
Access Groups
Check that the access groups generated are correctly restricted to the users they should allow.
It's specially important to check that the default access group isn't very open (it's not allowing too many people) as by default anyone in that group is going to be able to access applications.
Note that it's possible to give access to EVERYONE and other very open policies that aren't recommended unless 100% necessary.
Service Auth
Check that all service tokens expires in 1 year or less
Tunnels
TODO
My Team
TODO
Logs
You could search for unexpected actions from users
Settings
Check the plan type
It's possible to see the credits card owner name, last 4 digits, expiration date and address
It's recommended to add a User Seat Expiration to remove users that doesn't really use this service
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated