Scott Weston
Scott Weston is a remote Senior Security Consultant at NetSPI based out of Minneapolis, MN. He has 3-4 years of experience in information security/pentesting with his involvement including general web applications, GraphQL, AWS, and GCP. He has contributed to the open-source AWS pentesting tool, Pacu, by adding an enumeration module for AWS Organizations. He also created a large AWS deck designed for beginners to present to the local San Diego Defcon group located here(https://www.linkedin.com/posts/webbinroot_aws-from-zero-to-pacu-activity-6996999634782994432-q0oy/). He has participated in some bug bounties/VDPs and is mentioned on the International Committee of the Red Cross (ICRC) hall of fame(https://www.icrc.org/en/vulnerability-disclosure/hall-of-fame). He has recently been working on developing tooling for GCP pentesting. In his spare time, he enjoys pursuing individual bug bounties and interesting avenues of pentesting.
Session
When discussing the various cloud providers within the last decade, Google Cloud Platform (GCP) is often seen as the smaller provider following AWS and Azure with regards to market share. While GCP might appear smaller than its rival cloud providers, it still is very much in use today, and with this use comes the opportunities for developing pentesting tools. As I've been learning GCP over the last year, I have been making a framework in python (much like Pacu for AWS) specifically for GCP. This includes enumeration modules for some of the core services (Cloud Storage, Cloud Functions, Cloud Compute, IAM) along with the incorporation of numerous exploit modules, many of them rooted in Rhino Security's currently public GCP exploit repository (https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/tree/master). In addition, the framework is built such that it should be easy for a first-time GCP user or beginner to code and develop modules that focus on purely navigating individual resources and easily drop those into the framework. The overall goal is to make an up-to-date, maintained enumeration and exploit toolset for GCP pentesters/red teams/researchers alike that reduces the barrier of entry for learning GCP by allowing average users to make their own modules that easily incorporate with the overall framework.