Pentesting a GCP (Google Cloud Platform) infrastructure and the web applications deployed on it is a key step in identifying vulnerabilities and strengthening resilience against attacks.

This article presents the methodology adopted during a GCP infrastructure penetration test, the main types of tests performed, and some concrete examples.

In the development cycle of a web application, security should never be relegated to the background.

It must be considered at every stage: from the design phase, when choosing the architecture, throughout development, but also after deployment, through continuous testing.

Phishing remains one of the most formidable and widely used techniques in cyber attacks.

Exploiting human weakness, this method consists of tricking victims into divulging sensitive information, such as credentials, or performing compromising actions, such as clicking on malicious links.

Content Security Policy (CSP) is an essential security measure for protecting web applications against certain types of attack. By defining strict rules on the resources that a browser can load, a CSP limits potential attack vectors.

However, a poorly configured Content Security Policy can be bypassed, leaving the application vulnerable.

Before discussing techniques and tools, it is essential to define the ‘secrets’ sought during penetration tests.

These secrets are generally private character strings which, if compromised, can be used to access a system, break encryption or forge data useful for authentication. Examples include a username and password pair, API keys, private keys or a session token that is still valid.

AWS is a prime target for attackers. Its growing popularity and strategic role make it an attractive service.

To limit the risks, it is crucial to put in place robust security measures. Understanding the types of attack and assessing their impact is also essential.

Active Directory (AD) is at the heart of many organisations’ IT infrastructure. It manages authentication, authorisation and access to critical resources within a network.

However, its complexity and importance make it a prime target for attackers. A single vulnerability in an Active Directory can enable an attacker to quickly compromise an organisation’s entire network.

At a time when cyber attacks are increasing in frequency, sophistication and impact, traditional defensive approaches, while necessary, are no longer sufficient.

To effectively protect information systems and anticipate attacks, businesses need to adopt an offensive posture. This proactive approach encompasses practices such as pentests, Red Teaming and Assumed Breach assessments.