2. 👽 Welcome!
  3. HackTricks Cloud
  4. About the Author$$external:https://book.hacktricks.wiki/en/welcome/about-the-author.html$$
  5. HackTricks Values & faq$$external:https://book.hacktricks.wiki/en/welcome/hacktricks-values-and-faq.html$$
  7. 🏭 Pentesting CI/CD
  8. Pentesting CI/CD Methodology
  9. Docker Build Context Abuse in Cloud Envs
  10. Gitblit Security
    ❱
    1. Ssh Auth Bypass
  11. Github Security
    ❱
    1. Abusing Github Actions
      ❱
      1. Gh Actions - Artifact Poisoning
      2. GH Actions - Cache Poisoning
      3. Gh Actions - Context Script Injections
    2. Accessible Deleted Data in Github
    3. Basic Github Information
  12. Gitea Security
    ❱
    1. Basic Gitea Information
  13. Concourse Security
    ❱
    1. Concourse Architecture
    2. Concourse Lab Creation
    3. Concourse Enumeration & Attacks
  14. CircleCI Security
  15. TravisCI Security
    ❱
    1. Basic TravisCI Information
  16. Jenkins Security
    ❱
    1. Basic Jenkins Information
    2. Jenkins RCE with Groovy Script
    3. Jenkins RCE Creating/Modifying Project
    4. Jenkins RCE Creating/Modifying Pipeline
    5. Jenkins Arbitrary File Read to RCE via "Remember Me"
    6. Jenkins Dumping Secrets from Groovy
  17. Apache Airflow Security
    ❱
    1. Airflow Configuration
    2. Airflow RBAC
  18. Terraform Security
  19. Atlantis Security
  20. Cloudflare Security
    ❱
    1. Cloudflare Domains
    2. Cloudflare Workers Pass Through Proxy Ip Rotation
    3. Cloudflare Zero Trust Network
  21. Okta Security
    ❱
    1. Okta Hardening
  22. Serverless.com Security
  23. Supabase Security
  24. Check Automate Security
    ❱
    1. Chef Automate Enumeration And Attacks
  25. Vercel Security
  26. Ansible Tower / AWX / Automation controller Security
  27. TODO
  29. ⛈️ Pentesting Cloud
  30. Pentesting Cloud Methodology
    ❱
    1. Luks2 Header Malleability Null Cipher Abuse
  31. Kubernetes Pentesting
    ❱
    1. Kubernetes Basics
    2. Pentesting Kubernetes Services
      ❱
      1. Kubelet Authentication & Authorization
    3. Exposing Services in Kubernetes
    4. Attacking Kubernetes from inside a Pod
    5. Kubernetes Enumeration
    6. Kubernetes Role-Based Access Control(RBAC)
    7. Abusing Roles/ClusterRoles in Kubernetes
      ❱
      1. Pod Escape Privileges
      2. Kubernetes Roles Abuse Lab
    8. Kubernetes Namespace Escalation
    9. Kubernetes External Secret Operator
    10. Kubernetes Pivoting to Clouds
    11. Kubernetes Network Attacks
    12. Kubernetes Hardening
      ❱
      1. Kubernetes SecurityContext(s)
    13. Kubernetes OPA Gatekeeper
      ❱
      1. Kubernetes OPA Gatekeeper bypass
    14. Kubernetes Kyverno
      ❱
      1. Kubernetes Kyverno bypass
    15. Kubernetes ValidatingWebhookConfiguration
  32. GCP Pentesting
    ❱
    1. GCP - Basic Information
      ❱
      1. GCP - Federation Abuse
    2. GCP - Permissions for a Pentest
    3. GCP - Post Exploitation
      ❱
      1. GCP - App Engine Post Exploitation
      2. GCP - Artifact Registry Post Exploitation
      3. GCP - Bigtable Post Exploitation
      4. GCP - Cloud Build Post Exploitation
      5. GCP - Cloud Functions Post Exploitation
      6. GCP - Cloud Run Post Exploitation
      7. GCP - Cloud Shell Post Exploitation
      8. GCP - Cloud SQL Post Exploitation
      9. GCP - Compute Post Exploitation
      10. GCP - Filestore Post Exploitation
      11. GCP - IAM Post Exploitation
      12. GCP - KMS Post Exploitation
      13. GCP - Logging Post Exploitation
      14. GCP - Monitoring Post Exploitation
      15. GCP - Pub/Sub Post Exploitation
      16. GCP - Secretmanager Post Exploitation
      17. GCP - Security Post Exploitation
      18. GCP - Workflows Post Exploitation
      19. GCP - Storage Post Exploitation
    4. GCP - Privilege Escalation
      ❱
      1. GCP - Apikeys Privesc
      2. GCP - AppEngine Privesc
      3. GCP - Artifact Registry Privesc
      4. GCP - Batch Privesc
      5. GCP - BigQuery Privesc
      6. GCP - Bigtable Privesc
      7. GCP - ClientAuthConfig Privesc
      8. GCP - Cloudbuild Privesc
      9. GCP - Cloudfunctions Privesc
      10. GCP - Cloudidentity Privesc
      11. GCP - Cloud Scheduler Privesc
      12. GCP - Cloud Tasks Privesc
      13. GCP - Compute Privesc
        ❱
        1. GCP - Add Custom SSH Metadata
      14. GCP - Composer Privesc
      15. GCP - Container Privesc
      16. GCP - Dataproc Privesc
      17. GCP - Deploymentmaneger Privesc
      18. GCP - IAM Privesc
      19. GCP - KMS Privesc
      20. GCP - Orgpolicy Privesc
      21. GCP - Pubsub Privesc
      22. GCP - Resourcemanager Privesc
      23. GCP - Run Privesc
      24. GCP - Secretmanager Privesc
      25. GCP - Serviceusage Privesc
      26. GCP - Sourcerepos Privesc
      27. GCP - Storage Privesc
      28. GCP - Vertex AI Privesc
      29. GCP - Workflows Privesc
      30. GCP - Generic Permissions Privesc
      31. GCP - Network Docker Escape
      32. GCP - local privilege escalation ssh pivoting
    5. GCP - Persistence
      ❱
      1. GCP - API Keys Persistence
      2. GCP - App Engine Persistence
      3. GCP - Artifact Registry Persistence
      4. GCP - BigQuery Persistence
      5. GCP - Bigtable Persistence
      6. GCP - Cloud Functions Persistence
      7. GCP - Cloud Run Persistence
      8. GCP - Cloud Shell Persistence
      9. GCP - Cloud SQL Persistence
      10. GCP - Compute Persistence
      11. GCP - Dataflow Persistence
      12. GCP - Filestore Persistence
      13. GCP - Logging Persistence
      14. GCP - Secret Manager Persistence
      15. GCP - Storage Persistence
      16. GCP - Token Persistence
    6. GCP - Services
      ❱
      1. GCP - AI Platform Enum
      2. GCP - API Keys Enum
      3. GCP - App Engine Enum
      4. GCP - Artifact Registry Enum
      5. GCP - Batch Enum
      6. GCP - Bigquery Enum
      7. GCP - Bigtable Enum
      8. GCP - Cloud Build Enum
      9. GCP - Cloud Functions Enum
      10. GCP - Cloud Run Enum
      11. GCP - Cloud Shell Enum
      12. GCP - Cloud SQL Enum
      13. GCP - Cloud Scheduler Enum
      14. GCP - Compute Enum
        ❱
        1. GCP - Compute Instances
        2. GCP - VPC & Networking
      15. GCP - Composer Enum
      16. GCP - Containers & GKE Enum
      17. GCP - Dataproc Enum
      18. GCP - DNS Enum
      19. GCP - Filestore Enum
      20. GCP - Firebase Enum
      21. GCP - Firestore Enum
      22. GCP - IAM, Principals & Org Policies Enum
      23. GCP - KMS Enum
      24. GCP - Logging Enum
      25. GCP - Memorystore Enum
      26. GCP - Monitoring Enum
      27. GCP - Pub/Sub Enum
      28. GCP - Secrets Manager Enum
      29. GCP - Security Enum
      30. GCP - Source Repositories Enum
      31. GCP - Spanner Enum
      32. GCP - Stackdriver Enum
      33. GCP - Storage Enum
      34. GCP - Vertex AI Enum
      35. GCP - Workflows Enum
    7. GCP <--> Workspace Pivoting
      ❱
      1. GCP - Understanding Domain-Wide Delegation
    8. GCP - Unauthenticated Enum & Access
      ❱
      1. GCP - API Keys Unauthenticated Enum
      2. GCP - App Engine Unauthenticated Enum
      3. GCP - Artifact Registry Unauthenticated Enum
      4. GCP - Cloud Build Unauthenticated Enum
      5. GCP - Cloud Functions Unauthenticated Enum
      6. GCP - Cloud Run Unauthenticated Enum
      7. GCP - Cloud SQL Unauthenticated Enum
      8. GCP - Compute Unauthenticated Enum
      9. GCP - IAM, Principals & Org Unauthenticated Enum
      10. GCP - Source Repositories Unauthenticated Enum
      11. GCP - Storage Unauthenticated Enum
        ❱
        1. GCP - Public Buckets Privilege Escalation
  33. GWS - Workspace Pentesting
    ❱
    1. GWS - Post Exploitation
    2. GWS - Persistence
    3. GWS - Workspace Sync Attacks (GCPW, GCDS, GPS, Directory Sync with AD & EntraID)
      ❱
      1. GWS - Admin Directory Sync
      2. GCDS - Google Cloud Directory Sync
      3. GCPW - Google Credential Provider for Windows
      4. GPS - Google Password Sync
    4. GWS - Google Platforms Phishing
      ❱
      1. GWS - App Scripts
  34. AWS Pentesting
    ❱
    1. AWS - Basic Information
      ❱
      1. AWS - Federation Abuse
    2. AWS - Permissions for a Pentest
    3. AWS - Persistence
      ❱
      1. AWS - API Gateway Persistence
      2. AWS - Cloudformation Persistence
      3. AWS - Cognito Persistence
      4. AWS - DynamoDB Persistence
      5. AWS - EC2 Persistence
        ❱
        1. AWS - EC2 ReplaceRootVolume Task (Stealth Backdoor / Persistence)
      6. AWS - ECR Persistence
      7. AWS - ECS Persistence
      8. AWS - Elastic Beanstalk Persistence
      9. AWS - EFS Persistence
      10. AWS - IAM Persistence
      11. AWS - KMS Persistence
      12. AWS - Lambda Persistence
        ❱
        1. AWS - Abusing Lambda Extensions
        2. AWS - Lambda Alias Version Policy Backdoor
        3. AWS - Lambda Async Self Loop Persistence
        4. AWS - Lambda Layers Persistence
        5. AWS - Lambda Exec Wrapper Persistence
      13. AWS - Lightsail Persistence
      14. AWS - RDS Persistence
      15. AWS - S3 Persistence
      16. Aws Sagemaker Persistence
      17. AWS - SNS Persistence
      18. AWS - Secrets Manager Persistence
      19. AWS - SQS Persistence
        ❱
        1. AWS - SQS DLQ Backdoor Persistence via RedrivePolicy/RedriveAllowPolicy
        2. AWS - SQS OrgID Policy Backdoor
      20. AWS - SSM Perssitence
      21. AWS - Step Functions Persistence
      22. AWS - STS Persistence
    4. AWS - Post Exploitation
      ❱
      1. AWS - API Gateway Post Exploitation
      2. AWS - Bedrock Post Exploitation
      3. AWS - CloudFront Post Exploitation
      4. AWS - CodeBuild Post Exploitation
        ❱
        1. AWS Codebuild - Token Leakage
      5. AWS - Control Tower Post Exploitation
      6. AWS - DLM Post Exploitation
      7. AWS - DynamoDB Post Exploitation
      8. AWS - EC2, EBS, SSM & VPC Post Exploitation
        ❱
        1. AWS - EBS Snapshot Dump
        2. AWS – Covert Disk Exfiltration via AMI Store-to-S3 (CreateStoreImageTask)
        3. AWS - Live Data Theft via EBS Multi-Attach
        4. AWS - EC2 Instance Connect Endpoint backdoor + ephemeral SSH key injection
        5. AWS – EC2 ENI Secondary Private IP Hijack (Trust/Allowlist Bypass)
        6. AWS - Elastic IP Hijack for Ingress/Egress IP Impersonation
        7. AWS - Security Group Backdoor via Managed Prefix Lists
        8. AWS – Egress Bypass from Isolated Subnets via VPC Endpoints
        9. AWS - VPC Flow Logs Cross-Account Exfiltration to S3
        10. AWS - Malicious VPC Mirror
      9. AWS - ECR Post Exploitation
      10. AWS - ECS Post Exploitation
      11. AWS - EFS Post Exploitation
      12. AWS - EKS Post Exploitation
      13. AWS - Elastic Beanstalk Post Exploitation
      14. AWS - IAM Post Exploitation
      15. AWS - KMS Post Exploitation
      16. AWS - Lambda Post Exploitation
        ❱
        1. AWS - Lambda EFS Mount Injection
        2. AWS - Lambda Event Source Mapping Hijack
        3. AWS - Lambda Function URL Public Exposure
        4. AWS - Lambda LoggingConfig Redirection
        5. AWS - Lambda Runtime Pinning Abuse
        6. AWS - Lambda Steal Requests
        7. AWS - Lambda VPC Egress Bypass
      17. AWS - Lightsail Post Exploitation
      18. AWS - MWAA Post Exploitation
      19. AWS - Organizations Post Exploitation
      20. AWS - RDS Post Exploitation
      21. AWS - SageMaker Post-Exploitation
        ❱
        1. Feature Store Poisoning
      22. AWS - S3 Post Exploitation
      23. AWS - Secrets Manager Post Exploitation
      24. AWS - SES Post Exploitation
      25. AWS - SNS Post Exploitation
        ❱
        1. AWS - SNS Message Data Protection Bypass via Policy Downgrade
        2. SNS FIFO Archive Replay Exfiltration via Attacker SQS FIFO Subscription
        3. AWS - SNS to Kinesis Firehose Exfiltration (Fanout to S3)
      26. AWS - SQS Post Exploitation
        ❱
        1. AWS – SQS DLQ Redrive Exfiltration via StartMessageMoveTask
        2. AWS – SQS Cross-/Same-Account Injection via SNS Subscription + Queue Policy
      27. AWS - SSO & identitystore Post Exploitation
      28. AWS - Step Functions Post Exploitation
      29. AWS - STS Post Exploitation
      30. AWS - VPN Post Exploitation
    5. AWS - Privilege Escalation
      ❱
      1. AWS - Apigateway Privesc
      2. AWS - AppRunner Privesc
      3. AWS - Chime Privesc
      4. AWS - CloudFront
      5. AWS - Codebuild Privesc
      6. AWS - Codepipeline Privesc
      7. AWS - Codestar Privesc
        ❱
        1. codestar:CreateProject, codestar:AssociateTeamMember
        2. iam:PassRole, codestar:CreateProject
      8. AWS - Cloudformation Privesc
        ❱
        1. iam:PassRole, cloudformation:CreateStack,and cloudformation:DescribeStacks
      9. AWS - Cognito Privesc
      10. AWS - Datapipeline Privesc
      11. AWS - Directory Services Privesc
      12. AWS - DynamoDB Privesc
      13. AWS - EBS Privesc
      14. AWS - EC2 Privesc
      15. AWS - ECR Privesc
      16. AWS - ECS Privesc
      17. AWS - EFS Privesc
      18. AWS - Elastic Beanstalk Privesc
      19. AWS - EMR Privesc
      20. AWS - EventBridge Scheduler Privesc
      21. AWS - Gamelift
      22. AWS - Glue Privesc
      23. AWS - IAM Privesc
      24. AWS - KMS Privesc
      25. AWS - Lambda Privesc
      26. AWS - Lightsail Privesc
      27. AWS - Macie Privesc
      28. AWS - Mediapackage Privesc
      29. AWS - MQ Privesc
      30. AWS - MSK Privesc
      31. AWS - RDS Privesc
      32. AWS - Redshift Privesc
      33. AWS - Route53 Privesc
      34. AWS - SNS Privesc
      35. AWS - SQS Privesc
      36. AWS - SSO & identitystore Privesc
      37. AWS - Organizations Privesc
      38. AWS - S3 Privesc
      39. AWS - Sagemaker Privesc
      40. AWS - Secrets Manager Privesc
      41. AWS - SSM Privesc
      42. AWS - Step Functions Privesc
      43. AWS - STS Privesc
      44. AWS - WorkDocs Privesc
    6. AWS - Services
      ❱
      1. AWS - Security & Detection Services
        ❱
        1. AWS - CloudTrail Enum
        2. AWS - CloudWatch Enum
        3. AWS - Config Enum
        4. AWS - Control Tower Enum
        5. AWS - Cost Explorer Enum
        6. AWS - Detective Enum
        7. AWS - Firewall Manager Enum
        8. AWS - GuardDuty Enum
        9. AWS - Inspector Enum
        10. AWS - Security Hub Enum
        11. AWS - Shield Enum
        12. AWS - Trusted Advisor Enum
        13. AWS - WAF Enum
      2. AWS - API Gateway Enum
      3. AWS - Bedrock Enum
      4. AWS - Certificate Manager (ACM) & Private Certificate Authority (PCA)
      5. AWS - CloudFormation & Codestar Enum
      6. AWS - CloudHSM Enum
      7. AWS - CloudFront Enum
      8. AWS - Codebuild Enum
      9. AWS - Cognito Enum
        ❱
        1. Cognito Identity Pools
        2. Cognito User Pools
      10. AWS - DataPipeline, CodePipeline & CodeCommit Enum
      11. AWS - Directory Services / WorkDocs Enum
      12. AWS - DocumentDB Enum
      13. AWS - DynamoDB Enum
      14. AWS - EC2, EBS, ELB, SSM, VPC & VPN Enum
        ❱
        1. AWS - Nitro Enum
        2. AWS - VPC & Networking Basic Information
      15. AWS - ECR Enum
      16. AWS - ECS Enum
      17. AWS - EKS Enum
      18. AWS - Elastic Beanstalk Enum
      19. AWS - ElastiCache
      20. AWS - EMR Enum
      21. AWS - EFS Enum
      22. AWS - EventBridge Scheduler Enum
      23. AWS - Kinesis Data Firehose Enum
      24. AWS - IAM, Identity Center & SSO Enum
      25. AWS - KMS Enum
      26. AWS - Lambda Enum
      27. AWS - Lightsail Enum
      28. AWS - Macie Enum
      29. AWS - MQ Enum
      30. AWS - MSK Enum
      31. AWS - Organizations Enum
      32. AWS - Redshift Enum
      33. AWS - Relational Database (RDS) Enum
      34. AWS - Route53 Enum
      35. AWS - SageMaker Enum
      36. AWS - Secrets Manager Enum
      37. AWS - SES Enum
      38. AWS - SNS Enum
      39. AWS - SQS Enum
      40. AWS - S3, Athena & Glacier Enum
      41. AWS - Step Functions Enum
      42. AWS - STS Enum
      43. AWS - Other Services Enum
    7. AWS - Unauthenticated Enum & Access
      ❱
      1. AWS - Accounts Unauthenticated Enum
      2. AWS - API Gateway Unauthenticated Enum
      3. AWS - Cloudfront Unauthenticated Enum
      4. AWS - Cognito Unauthenticated Enum
      5. AWS - CodeBuild Unauthenticated Access
      6. AWS - DocumentDB Unauthenticated Enum
      7. AWS - DynamoDB Unauthenticated Access
      8. AWS - EC2 Unauthenticated Enum
      9. AWS - ECR Unauthenticated Enum
      10. AWS - ECS Unauthenticated Enum
      11. AWS - Elastic Beanstalk Unauthenticated Enum
      12. AWS - Elasticsearch Unauthenticated Enum
      13. AWS - IAM & STS Unauthenticated Enum
      14. AWS - Identity Center & SSO Unauthenticated Enum
      15. AWS - IoT Unauthenticated Enum
      16. AWS - Kinesis Video Unauthenticated Enum
      17. AWS - Lambda Unauthenticated Access
      18. AWS - Media Unauthenticated Enum
      19. AWS - MQ Unauthenticated Enum
      20. AWS - MSK Unauthenticated Enum
      21. AWS - RDS Unauthenticated Enum
      22. AWS - Redshift Unauthenticated Enum
      23. AWS - SageMaker Unauthenticated Enum
      24. AWS - SQS Unauthenticated Enum
      25. AWS - SNS Unauthenticated Enum
      26. AWS - S3 Unauthenticated Enum
  35. Azure Pentesting
    ❱
    1. Az - Basic Information
      ❱
      1. Az Federation Abuse
      2. Az - Tokens & Public Applications
    2. Az - Enumeration Tools
    3. Az - Unauthenticated Enum & Initial Entry
      ❱
      1. Az - Container Registry Unauth
      2. Az - OAuth Apps Phishing
      3. Az - Storage Unauth
      4. Az - VMs Unauth
      5. Az - Device Code Authentication Phishing
      6. Az - Password Spraying
    4. Az - Services
      ❱
      1. Az - Entra ID (AzureAD) & Azure IAM
      2. Az - ACR
      3. Az - Application Proxy
      4. Az - ARM Templates / Deployments
      5. Az - Automation Accounts
      6. Az - Azure App Services
      7. Az - Cloud Shell
      8. Az - Container Registry
      9. Az - Container Instances, Apps & Jobs
      10. Az - CosmosDB
      11. Az - Defender
      12. Az - File Shares
      13. Az - Front Door
      14. Az - Function Apps
      15. Az - Intune
      16. Az - Key Vault
      17. Az - Logic Apps
      18. Az - Management Groups, Subscriptions & Resource Groups
      19. Az - Misc
      20. Az - Monitoring
      21. Az - MySQL
      22. Az - PostgreSQL
      23. Az - Queue Storage
      24. Az - Sentinel
      25. Az - Service Bus
      26. Az - SQL
      27. Az - Static Web Applications
      28. Az - Storage Accounts & Blobs
      29. Az - Table Storage
      30. Az - Virtual Desktop
      31. Az - Virtual Machines & Network
        ❱
        1. Az - Azure Network
    5. Az - Permissions for a Pentest
    6. Az - Lateral Movement (Cloud - On-Prem)
      ❱
      1. Az - Arc vulnerable GPO Deploy Script
      2. Az - Cloud Kerberos Trust
      3. Az - Cloud Sync
      4. Az - Connect Sync
      5. Az - Domain Services
      6. Az - Federation
      7. Az - Hybrid Identity Misc Attacks
      8. Az - Local Cloud Credentials
      9. Az - Pass the Certificate
      10. Az - Pass the Cookie
      11. Az - Primary Refresh Token (PRT)
      12. Az - PTA - Pass-through Authentication
      13. Az - Seamless SSO
    7. Az - Post Exploitation
      ❱
      1. Az Azure Ai Foundry Post Exploitation
      2. Az - Blob Storage Post Exploitation
      3. Az - CosmosDB Post Exploitation
      4. Az - File Share Post Exploitation
      5. Az - Function Apps Post Exploitation
      6. Az - Key Vault Post Exploitation
      7. Az - Logic Apps Post Exploitation
      8. Az - MySQL Post Exploitation
      9. Az - PostgreSQL Post Exploitation
      10. Az - Queue Storage Post Exploitation
      11. Az - Service Bus Post Exploitation
      12. Az - Table Storage Post Exploitation
      13. Az - SQL Post Exploitation
      14. Az - Virtual Desktop Post Exploitation
      15. Az - VMs & Network Post Exploitation
    8. Az - Privilege Escalation
      ❱
      1. Az - Azure IAM Privesc (Authorization)
      2. Az - App Services Privesc
      3. Az - Automation Accounts Privesc
      4. Az - Container Registry Privesc
      5. Az - Container Instances, Apps & Jobs Privesc
      6. Az - CosmosDB Privesc
      7. Az - EntraID Privesc
        ❱
        1. Az - Conditional Access Policies & MFA Bypass
        2. Az - Dynamic Groups Privesc
      8. Az - Functions App Privesc
      9. Az - Key Vault Privesc
      10. Az - Logic Apps Privesc
      11. Az - MySQL Privesc
      12. Az - PostgreSQL Privesc
      13. Az - Queue Storage Privesc
      14. Az - Service Bus Privesc
      15. Az - Static Web App Privesc
      16. Az - Storage Privesc
      17. Az - SQL Privesc
      18. Az - Virtual Desktop Privesc
      19. Az - Virtual Machines & Network Privesc
    9. Az - Persistence
      ❱
      1. Az - Automation Accounts Persistence
      2. Az - Cloud Shell Persistence
      3. Az - Logic Apps Persistence
      4. Az - SQL Persistence
      5. Az - Queue Storage Persistence
      6. Az - VMs Persistence
      7. Az - Storage Persistence
    10. Az - Device Registration
  36. Digital Ocean Pentesting
    ❱
    1. DO - Basic Information
    2. DO - Permissions for a Pentest
    3. DO - Services
      ❱
      1. DO - Apps
      2. DO - Container Registry
      3. DO - Databases
      4. DO - Droplets
      5. DO - Functions
      6. DO - Images
      7. DO - Kubernetes (DOKS)
      8. DO - Networking
      9. DO - Projects
      10. DO - Spaces
      11. DO - Volumes
  37. IBM Cloud Pentesting
    ❱
    1. IBM - Hyper Protect Crypto Services
    2. IBM - Hyper Protect Virtual Server
    3. IBM - Basic Information
  38. OpenShift Pentesting
    ❱
    1. OpenShift - Basic information
    2. Openshift - SCC
    3. OpenShift - Jenkins
      ❱
      1. OpenShift - Jenkins Build Pod Override
    4. OpenShift - Privilege Escalation
      ❱
      1. OpenShift - Missing Service Account
      2. OpenShift - Tekton
      3. OpenShift - SCC bypass
  40. 🛫 Pentesting Network Services
  41. HackTricks Pentesting Network$$external:https://book.hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-network/index.html$$
  42. HackTricks Pentesting Services$$external:https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-ssh.html$$