Overview
PhantomWave is an entry-level GCP cloud penetration testing range. It was built to teach real-world red team tradecraft across web, identity, and Google Cloud attack chains.
Scenario
Enormous-Air, a major airline, has migrated its infrastructure to the Google Cloud Platform for scalability and stability.
Its cloud environment has never been tested. The job is to assess it end to end: exploit web-facing vulnerabilities to gain an initial foothold, then chain misconfigurations to move deeper and escalate across the GCP estate without destabilizing production.
Skills Needed
- Working knowledge of GCP and the Linux CLI
- Knowledge of web vulnerabilities (OWASP Top 10)
- Experience assessing cloud infrastructure
- Ability to undertake independent research
Real World Context
As organizations migrate to Google Cloud, it is critical that they thoroughly examine and lock down their services.
A single misconfiguration or overly permissive service account can be the foothold a threat actor needs to gain access and move laterally across the environment.