GCPwn: Bringing BloodHound OpenGraph Support to GCP

GCPwn began as an offensive Google Cloud enumeration and exfiltration tool designed to help pentesters discover resources, permissions, credentials, and paths to compromise. As the project evolved, I wanted to move beyond flat enumeration and visualize how those permissions actually connect to real attack paths.

This led to bringing BloodHound’s OpenGraph model to GCP. GCPwn can now transform permissions discovered through testIamPermissions, IAM policy bindings, and other enumeration techniques into graph relationships, while accounting for important GCP concepts such as IAM inheritance, conditional bindings, resource hierarchy, and identity relationships.

This talk will cover GCPwn’s OpenGraph addition exploring how GCP’s authorization model can be represented as a graph assisting those who are not as cloud verbose to understanding the overall architecture. Those relationships can reveal paths to privilege escalation and compromise that are difficult to identify through traditional enumeration alone.

The ultimate goal is to provide GCP OpenGraph support that gives blue teamers and pentesters alike a powerful way to visualize, investigate, and identify Google Cloud attack paths—open source, free, and simple.