GCP - IAM, Principals & Org Unauthenticated Enum
Iam & GCP Principals
For more information check:
Is domain used in Workspace?
Check DNS records
If it has a google-site-verification
record it's probable that it's (or it was) using Workspace:
If something like include:_spf.google.com
also appears it confirms it (note that if it doesn't appear it doesn't denies it as a domain can be in Workspace without using gmail as mail provider).
Try to setup a Workspace with that domain
Another option is to try to setup a Workspace using the domain, if it complains that the domain is already used (like in the image), you know it's already used!
To try to setup a Workspace domain follow: https://workspace.google.com/business/signup/welcome
Try to recover the password of an email using that domain
If you know any valid email address being use din that domain (like: admin@email.com or info@email.com) you can try to recover the account in https://accounts.google.com/signin/v2/recoveryidentifier, and if try doesn't shows an error indicating that Google has no idea about that account, then it's using Workspace.
Enumerate emails and service accounts
It's possible to enumerate valid emails of a Workspace domain and SA emails by trying to assign them permissions and checking the error messages. For this you just need to have permissions to assign permission to a project (which can be just owned by you).
Note that to check them but even if they exist not grant them a permission you can use the type serviceAccount
when it's an user
and user
when it's a SA
:
A faster way to enumerate Service Accounts in know projects is just to try to access to the URL: https://iam.googleapis.com/v1/projects/<project-id>/serviceAccounts/<sa-email>
For examlpe: https://iam.googleapis.com/v1/projects/gcp-labs-3uis1xlx/serviceAccounts/appengine-lab-1-tarsget@gcp-labs-3uis1xlx.iam.gserviceaccount.com
If the response is a 403, it means that the SA exists. But if the answer is a 404 it means that it doesn't exist:
Note how when the user email was valid the error message indicated that they type isn't, so we managed to discover that the email support@hacktricks.xyz exists without granting it any privileges.
You can so the same with Service Accounts using the type user:
instead of serviceAccount:
:
Last updated