ine-labs / GCPGoat

GCPGoat : A Damn Vulnerable GCP Infrastructure
MIT License
357 stars 77 forks source link

GCPGoat : A Damn Vulnerable GCP Infrastructure

Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since the cloud is relatively new, many developers are not fully aware of the threatscape and they end up deploying a vulnerable cloud infrastructure.

GCPGoat is a vulnerable by design infrastructure on GCP featuring the latest released OWASP Top 10 web application security risks (2021) and other misconfiguration based on services such as IAM, Storage Bucket, Cloud Functions and Compute Engine. GCPGoat mimics real-world infrastructure but with added vulnerabilities. It features multiple escalation paths and is focused on a black-box approach.

GCPGoat uses IaC (Terraform) to deploy the vulnerable cloud infrastructure on the user's GCP account. This gives the user complete control over code, infrastructure, and environment. Using GCPGoat, the user can learn/practice:

The project will be divided into modules and each module will be a separate web application, powered by varied tech stacks and development practices. It will leverage IaC through terraform to ease the deployment process.

Hits

Presented at

Developed with :heart: by INE

drawing

Built With

Vulnerabilities

The project is scheduled to encompass all significant vulnerabilities including the OWASP TOP 10 2021, and popular cloud misconfigurations. Currently, the project contains the following vulnerabilities/misconfigurations.

Getting Started

Prerequisites

Installation

Manually installing GCPGoat would require you to follow these steps:

(Note: This requires a Linux Machine, with the /bin/bash shell available)

Step 1. Clone the repo

git clone https://github.com/ine-labs/GCPGoat

Step 2. Configure the GCP User Account Credentials using gcloud CLI

gcloud auth application-default login

Step 3. Insert the Billing Account name in main.tf file

data "google_billing_account" "acct" {
  display_name = "<Your Billing Account Name>"
}

Step 4. In the same working directory use terraform to deploy GCPGoat.

terraform init
terraform apply --auto-approve

Modules

Module 1

The first module features a serverless blog application utilizing Cloud Functions, Cloud Storage Buckets, Compute Engine and Firestore. It consists of various web application vulnerabilities and facilitates exploitation of misconfigured GCP resources.

Escalation Path:

Recommended Browser: Google Chrome

Pricing

The resources created with the deployment of GCPGoat will not incur any charges if the GCP account is under the free tier/trial period. However, upon exhaustion/ineligibility of the free tier/trial, the following charges will apply for the US-East region:

Module 1: $0.03/hour

Contributors

Nishant Sharma, Director, Lab Platform, INE nsharma@ine.com

Jeswin Mathai, Chief Architect, Lab Platform, INE jmathai@ine.com

Sherin Stephen, Software Engineer (Cloud), INE sstephen@ine.com

Divya Nain, Software Engineer (Cloud), INE dnain@ine.com

Rishappreet Singh Moon, Software Engineer (Cloud), INE rmoon@ine.com

Litesh Ghute, Software Engineer (Cloud), INE lghute@ine.com

Sanjeev Mahunta, Software Engineer (Cloud), INE smahunta@ine.com

Solutions

The offensive manuals are available in the attack-manuals directory, and the defensive manuals are available in the defence-manuals directory.

Screenshots

Module 1:

Contribution Guidelines

License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License.

You should have received a copy of the MIT License along with this program. If not, see https://opensource.org/licenses/MIT.

Sister Projects