CLI Module Reference

CLI Module Reference

If you are new to GCPwn, read Getting Started first.

This page covers the modules REPL commands and the shared runner flags that apply across most modules. For the full per-module flag reference, see:

• Enumeration Module Reference — all enum_*, workspace, and unauthenticated modules
• Process Module Reference — process_gcp_iam_bindings, process_og_gcpwn_data, process_og_node_color_images, process_og_attack_paths
• Exploit Module Reference — all exploit_* modules with flag tables, required permissions, and examples

Runner Commands

modules list                          # list all registered modules
modules search <keyword>              # search by name or keyword
modules info <module_name>            # show module description and flags
modules run <module_name> [flags...]  # run a module
modules run <module_name> -h          # show module-specific help

Module Categories

Category	Count
Enumeration	81
Exploit	49
Process	4
Unauthenticated	5

Runner Flags

These flags are shared across most enumeration modules:

Flag	Meaning
--iam	Run testIamPermissions checks on each discovered resource
--get	Fetch deeper per-resource metadata
--download	Download artifact/content output (module-specific)
--project-id, --project-ids, --project-id-file, --current-project, --all-projects	Scope the run to specific projects
--all-regions / --regions-list / --regions-file	Scope the run to specific regions
-v, --debug	Verbose output

On the orchestrators (enum_all / enum_gcp) you can also limit which service enumerators run:

Flag	Meaning
--modules <tokens>	Run only the named services (comma/space-separated tokens; same vocabulary as --list-modules)
--dont-modules <tokens> (alias --exclude-modules)	Run everything except the named services

Both accept the same tokens; exclusion wins if a service is named in both. They compose with --filter-enabled-services and --parallel-services.

Always verify module-specific flags with modules run <module_name> -h.

--iam and testIamPermissions

testIamPermissions is a GCP API endpoint (POST /v1/{resource}:testIamPermissions) that answers "which of these permissions does my credential actually hold on this resource?" You pass it a list of permissions you want to check; it returns only the subset your caller actually has — without needing getIamPolicy or any admin role. GCPwn's --iam flag calls this endpoint for every resource a module discovers, records the results in the session's permission evidence store, and surfaces them in creds info.

Example: you check three permissions on a Cloud Storage bucket and get back one:

Request:  permissions: ["storage.buckets.delete", "storage.objects.list", "storage.buckets.getIamPolicy"]
Response: permissions: ["storage.objects.list"]

GCPwn records storage.objects.list as confirmed via testIamPermissions for that bucket. The other two are absent from the response — not held.

# Enumerate IAM service accounts and test permissions on each
modules run enum_iam --service-accounts --iam

# Enumerate Cloud Storage buckets and test permissions on each bucket
modules run enum_cloudstorage --buckets --iam

# Full cross-service sweep with IAM checks
modules run enum_gcp --iam

To instead brute-force the full permission catalog at a project/folder/org scope (via --all-permissions on enum_resources), see Common Use Cases — Use Case 3.

Modules with --iam Support (per-module testIamPermissions coverage)

Module	Resources tested with testIamPermissions
enum_agentplatform	Datasets, models, featurestores, feature groups, reasoning engines (endpoints unsupported)
enum_apigateway	Gateways, APIs, configs
enum_app_integration_resources	Integrations
enum_artifactregistry	Repositories
enum_bigquery	Tables, routines
enum_bigtable	Instances, tables
enum_cloudbuild	Connections only
enum_cloudcompute_lb	Load balancer resources
enum_cloudcompute_network	Network resources
enum_cloudcompute_resources	VM instances
enum_clouddeploy	Delivery pipelines, targets
enum_clouddns	Zones
enum_cloudfunctions	Functions (v1 + v2)
enum_cloudrun	Services, jobs
enum_cloudstorage	Buckets
enum_cloudtasks	Queues
enum_dataflow_datapipelines	Data Pipelines
enum_dataform	Repositories, workspaces
enum_firebase	Firebase resources
enum_iam	Service accounts
enum_inframanager	Deployments
enum_integration_connectors	Connectors
enum_kms	Keyrings, keys
enum_notebooks	Notebook instances
enum_pubsub	Topics, subscriptions
enum_resources	Projects, folders, orgs (also supports --all-permissions for deep sweep)
enum_secretsmanager	Secrets, versions
enum_servicedirectory	Namespaces, services (endpoints unsupported)
enum_spanner	Instances, databases
enum_vertex	Vertex AI resources
enum_workstations	Workstation configs, workstations

Running Any Module

Every module runs three ways (shared options are the Runner Flags table above):

• In the REPL: modules run <module_name> [flags]
• Non-interactive (authenticated): gcpwn --module <module_name> --workspace WORKSPACE_NAME --cred CRED_NAME [project selector] [flags] — workspace and credential must already exist (set up via the REPL first). See Common Use Cases — Non-Interactive Run.
• Non-interactive (unauthenticated): gcpwn --module <unauth_module> [flags]

Resuming a long run: enum_all / enum_gcp / enum_gcp_policy_bindings / enum_google_workspace print a per-run resume token; pass --resume <token> to continue an interrupted run. See Authentication Reference — Resuming Long Runs.

For the full per-module flag reference, see:

• Enumeration Module Reference — all enum_*, workspace, and unauthenticated modules
• Process Module Reference — post-enumeration processing modules
• Exploit Module Reference — all exploit_* modules with flag tables, required permissions, and examples