Cloud Storage

Abusable GCP Cloud Storage enumeration techniques

Object Versioning

• When versioning is enabled on a bucket, GCS retains every generation of an object on overwrite or delete rather than destroying it. With storage.objects.list, an attacker can enumerate all generations and fetch any non-current version directly — recovering secrets, keys, or files the owner believed were gone.

gcloud storage ls --all-versions gs://<BUCKET_NAME>/

gcloud storage cp gs://<BUCKET_NAME>/<OBJECT>#<GENERATION_NUMBER> -

---

Identifying Public Buckets

• GCP bucket names are globally unique, and their contents can be publicly exposed depending on how IAM is configured.

• Tools like cloud_enum can automate bucket discovery and access checks.

• For a bucket or its objects to be readable, the principal must have storage.objects.get (e.g., via roles/storage.objectViewer).

• The big misconfiguration is when this is granted to:

  • allUsers — anyone on the internet, no authentication required

  • allAuthenticatedUsers — anyone with any Google account

uv run cloud_enum.py -k test9273492374 --disable-aws --disable-azure 2>&1

[+] Checking for Google buckets
  OPEN GOOGLE BUCKET: http://storage.googleapis.com/test9273492374
      FILES:
      ->http://storage.googleapis.com/test9273492374/test9273492374
      ->http://storage.googleapis.com/test9273492374/test/