--- title: Introducing CloudFox GCP: Attack Path Identification for... description: Bishop Fox has released CloudFox GCP, an open-source extension of its CloudFox attack-path tool that brings offensive-security enumeration and analysis to... canonical: https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing CloudFox GCP: Attack Path Identification for Google Cloud | daily.dev og:description: Bishop Fox has released CloudFox GCP, an open-source extension of its CloudFox attack-path tool that brings offensive-security enumeration and analysis to... og:url: https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv og:image: https://api.daily.dev/og/posts/vGpRVLTPV.png og:image:alt: Introducing CloudFox GCP: Attack Path Identification for Google Cloud og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing CloudFox GCP: Attack Path Identification for Google Cloud **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 13 min read · 0 upvotes · 0 comments ## Summary Bishop Fox has released CloudFox GCP, an open-source extension of its CloudFox attack-path tool that brings offensive-security enumeration and analysis to Google Cloud Platform. The launch ships with 64 modules spanning IAM mapping, storage and secrets exposure, compute and container security, network analysis, and attack-path detection. It integrates with FoxMapper, a soon-to-be-released privilege-escalation graph tool built on NCC Group's PMapper, to surface privilege escalation chains, lateral movement paths, and data exfiltration risks. The tool introduces hierarchical output mirroring GCP's Organization/Folder/Project structure, requires only read permissions, and is available now via GitHub with plans to expand into Azure, Kubernetes, multi-cloud attack paths, and CI/CD security analysis. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CloudFox GCP and what does it do? CloudFox GCP is an open-source module suite from Bishop Fox that extends the CloudFox attack-path tool to Google Cloud Platform. It launches with 64 modules covering IAM enumeration, storage and secrets exposure, compute and container security, network analysis, and attack path detection, requiring only read permissions to assess an environment without modifying it. _Teams evaluating cloud security tooling can track new offensive security releases like this on daily.dev._ ### How does CloudFox GCP identify privilege escalation paths in Google Cloud? CloudFox GCP's privesc module integrates with FoxMapper, a soon-to-be-released graph-analysis tool built on NCC Group's PMapper, to surface over 60 known privilege escalation techniques including service account impersonation, key creation, IAM policy modification, and resource deployment abuse, generating ready-to-use exploitation playbooks for each identified chain. _Security engineers researching IAM privilege escalation tooling can follow updates like FoxMapper on daily.dev._ ### What GCP permissions are needed to run CloudFox GCP for a full assessment? A comprehensive organization-wide assessment needs roles/resourcemanager.organizationViewer, roles/iam.securityReviewer, roles/cloudasset.viewer, and roles/cloudidentity.groupsViewer at the organization level, plus roles/resourcemanager.folderViewer at the folder level and roles/viewer at the project level. For a single-project scan, roles/viewer alone is sufficient for basic enumeration. _Practitioners setting up cloud assessment permissions can find tooling guides like this via daily.dev._ ## Similar posts on daily.dev - [7 GCP Misconfigurations That Are Actively Being Exploited in 2026](https://daily.dev/posts/7-gcp-misconfigurations-that-are-actively-being-exploited-in-2026-8gemotlze) · Security Boulevard · 0 upvotes · 0 comments - [Cloud Atlas group acquires new tools](https://daily.dev/posts/cloud-atlas-group-acquires-new-tools-dshnjta3i) · Securelist · 0 upvotes · 0 comments - [How Google Cloud detects, contains, and protects against emerging threats](https://daily.dev/posts/how-google-cloud-detects-contains-and-protects-against-emerging-threats-znvhdqka4) · Google Cloud · 1 upvotes · 0 comments - ['Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure](https://daily.dev/posts/confused-deputy-flaws-persist-in-google-cloud-microsoft-azure-zjv88pgod) · Dark Reading · 1 upvotes · 0 comments - [How to Improve Cloud Security Posture With CSPM: Visualizing the Attack Path](https://daily.dev/posts/how-to-improve-cloud-security-posture-with-cspm-visualizing-the-attack-path-los5t9ozu) · Orca Security Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#gcp](https://daily.dev/tags/gcp), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing CloudFox GCP: Attack Path Identification for Google Cloud","url":"https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv"},"datePublished":"2026-08-23T12:21:39.706Z","dateModified":"2026-08-23T12:38:19.466Z","description":"Bishop Fox has released CloudFox GCP, an open-source extension of its CloudFox attack-path tool that brings offensive-security enumeration and analysis to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e42404733f1e7160d685eab70e1332b0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e42404733f1e7160d685eab70e1332b0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,gcp,iam","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Introducing CloudFox GCP: Attack Path Identification for Google Cloud"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-cloudfox-gcp-attack-path-identification-for-google-cloud-vgprvltpv#faq","mainEntity":[{"@type":"Question","name":"What is CloudFox GCP and what does it do?","acceptedAnswer":{"@type":"Answer","text":"CloudFox GCP is an open-source module suite from Bishop Fox that extends the CloudFox attack-path tool to Google Cloud Platform. It launches with 64 modules covering IAM enumeration, storage and secrets exposure, compute and container security, network analysis, and attack path detection, requiring only read permissions to assess an environment without modifying it. Teams evaluating cloud security tooling can track new offensive security releases like this on daily.dev."}},{"@type":"Question","name":"How does CloudFox GCP identify privilege escalation paths in Google Cloud?","acceptedAnswer":{"@type":"Answer","text":"CloudFox GCP's privesc module integrates with FoxMapper, a soon-to-be-released graph-analysis tool built on NCC Group's PMapper, to surface over 60 known privilege escalation techniques including service account impersonation, key creation, IAM policy modification, and resource deployment abuse, generating ready-to-use exploitation playbooks for each identified chain. Security engineers researching IAM privilege escalation tooling can follow updates like FoxMapper on daily.dev."}},{"@type":"Question","name":"What GCP permissions are needed to run CloudFox GCP for a full assessment?","acceptedAnswer":{"@type":"Answer","text":"A comprehensive organization-wide assessment needs roles/resourcemanager.organizationViewer, roles/iam.securityReviewer, roles/cloudasset.viewer, and roles/cloudidentity.groupsViewer at the organization level, plus roles/resourcemanager.folderViewer at the folder level and roles/viewer at the project level. For a single-project scan, roles/viewer alone is sufficient for basic enumeration. Practitioners setting up cloud assessment permissions can find tooling guides like this via daily.dev."}}]} ```