Home

GCPwn Wiki

GCPwn is a Google Cloud offensive security assessment framework for workspace-driven credential handling, service enumeration, artifact collection, and graph-based attack-path analysis.

Getting Started

1. Getting Started
2. Authentication Reference
3. Common Use Cases
4. Workspace Instructions
5. CLI Module Reference
6. Downloads to Disk
7. Data View/Export

IAM + OpenGraph Workflows

• IAM Enumeration and Analysis Workflow
• OpenGraph Overview and Usage
• OpenGraph - Node/Edge Tables
• OpenGraph - Default Priv Escalation Mode
• OpenGraph - IAM Conditionals
• OpenGraph - Inheritance & Include-All
• OpenGraph - Add Your Own Content

Development and Operations

• Module Development Guide
• Troubleshooting and FAQ

Recommended Baseline Run

modules run enum_all --iam
modules run enum_policy_bindings --ensure-tree
modules run process_iam_bindings
modules run enum_gcp_cloud_hound_data --expand-inherited --reset --out Bloodhound_Output.json

Export collected data:

data export csv
data export json
data export excel

If your goal is custom attack-path modeling, go directly to OpenGraph - Add Your Own Content.