GCP - IAM, Principals & Org Unauthenticated Enum
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For more information check:
GCP - IAM, Principals & Org Policies EnumCheck DNS records
If it has a google-site-verification record it's probable that it's (or it was) using Workspace:
If something like include:_spf.google.com also appears it confirms it (note that if it doesn't appear it doesn't denies it as a domain can be in Workspace without using gmail as mail provider).
Try to setup a Workspace with that domain
Another option is to try to setup a Workspace using the domain, if it complains that the domain is already used (like in the image), you know it's already used!
To try to setup a Workspace domain follow: https://workspace.google.com/business/signup/welcome
Try to recover the password of an email using that domain
If you know any valid email address being use din that domain (like: admin@email.com or info@email.com) you can try to recover the account in https://accounts.google.com/signin/v2/recoveryidentifier, and if try doesn't shows an error indicating that Google has no idea about that account, then it's using Workspace.
It's possible to enumerate valid emails of a Workspace domain and SA emails by trying to assign them permissions and checking the error messages. For this you just need to have permissions to assign permission to a project (which can be just owned by you).
Note that to check them but even if they exist not grant them a permission you can use the type serviceAccount when it's an user and user when it's a SA:
A faster way to enumerate Service Accounts in know projects is just to try to access to the URL: https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/<sa-email>
For examlpe: https://iam.googleapis.com/v1/projects/gcp-labs-3uis1xlx/serviceAccounts/appengine-lab-1-tarsget@gcp-labs-3uis1xlx.iam.gserviceaccount.com
If the response is a 403, it means that the SA exists. But if the answer is a 404 it means that it doesn't exist:
Note how when the user email was valid the error message indicated that they type isn't, so we managed to discover that the email support@hacktricks.xyz exists without granting it any privileges.
You can so the same with Service Accounts using the type user: instead of serviceAccount::
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
