GCP - App Engine Post Exploitation

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

App Engine

Kwa maelezo kuhusu App Engine angalia:

GCP - App Engine Enum

appengine.memcache.addKey | appengine.memcache.list | appengine.memcache.getKey | appengine.memcache.flush

Kwa ruhusa hizi inawezekana:

• Kuongeza funguo

• Orodhesha funguo

• Pata funguo

• Futa

Hata hivyo, sikuweza kupata njia yoyote ya kufikia taarifa hii kutoka kwa cli, tu kutoka kwenye web console ambapo unahitaji kujua Aina ya Funguo na Jina la Funguo, au kutoka kwenye app engine inayotembea.

Ikiwa unajua njia rahisi za kutumia ruhusa hizi tuma Pull Request!

logging.views.access

Kwa ruhusa hii inawezekana kuona kumbukumbu za App:

gcloud app logs tail -s <name>

Read Source Code

Msimbo wa chanzo wa matoleo yote na huduma uhifadhiwa katika bucket yenye jina staging.<proj-id>.appspot.com. Ikiwa una ufikiaji wa kuandika juu yake unaweza kusoma msimbo wa chanzo na kutafuta vulnerabilities na sensitive information.

Modify Source Code

Badilisha msimbo wa chanzo ili kuiba akreditivu ikiwa zinatumwa au fanya shambulio la defacement kwenye wavuti.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.