f

Author: carlospolop

scripts/seo_postprocess.py

@@ -38,6 +38,16 @@
         "Kubernetes, CI/CD, and workspace pentesting techniques."
     ),
 }
+SITE_ALTERNATE_NAMES = {
+    "HackTricks Cloud": ["HT Cloud", "HackTricks Wiki Cloud"],
+}
+SITE_SAME_AS = {
+    "HackTricks Cloud": [
+        "https://github.com/HackTricks-wiki/hacktricks-cloud",
+        "https://www.linkedin.com/company/hacktricks",
+        "https://twitter.com/hacktricks_live",
+    ],
+}
 LANGUAGE_LOCALES = {
     "af": "af_ZA",
     "de": "de_DE",
@@ -163,10 +173,6 @@ def homepage_description(site_name):
     return SITE_DESCRIPTIONS.get(site_name, f"{site_name}: practical cloud security guides and references.")
 
 
-def strip_index_suffix(path):
-    return re.sub(r"(?:^|/)index\.html$", "", path.as_posix())
-
-
 def is_homepage(rel_path):
     return rel_path.as_posix() == "index.html"
 
@@ -211,52 +217,75 @@ def humanize_slug(value):
 
 def breadcrumb_items(site_url, lang, rel_path):
     items = [{"name": "Home", "url": canonical_url(site_url, lang, Path("index.html"))}]
-    bare_path = strip_index_suffix(rel_path)
-    if not bare_path:
+    if is_homepage(rel_path):
         return items
 
-    parts = [part for part in bare_path.split("/") if part]
-    for idx in range(len(parts)):
-        crumb_rel = Path(*parts[: idx + 1], "index.html")
-        items.append({"name": humanize_slug(parts[idx]), "url": canonical_url(site_url, lang, crumb_rel)})
+    if rel_path.name == "index.html":
+        directory_parts = list(rel_path.parent.parts)
+        page_name = None
+    else:
+        directory_parts = [] if rel_path.parent == Path(".") else list(rel_path.parent.parts)
+        page_name = rel_path.name
+
+    for idx, part in enumerate(directory_parts):
+        crumb_rel = Path(*directory_parts[: idx + 1], "index.html")
+        items.append({"name": humanize_slug(part), "url": canonical_url(site_url, lang, crumb_rel)})
+
+    if page_name:
+        items.append({"name": humanize_slug(page_name), "url": canonical_url(site_url, lang, rel_path)})
+
     return items
 
 
-def build_structured_data(site_url, lang, rel_path, title, description, site_name, image_url, languages):
+def build_structured_data(site_url, lang, rel_path, title, description, site_name, image_url, languages, lastmod):
     current_url = canonical_url(site_url, lang, rel_path)
     site_root = site_url.rstrip("/")
-    website_url = canonical_url(site_url, "en", Path("index.html"))
-    data = [
-        {
-            "@context": "https://schema.org",
-            "@type": "Organization",
-            "@id": f"{site_root}/#organization",
-            "name": site_name,
-            "url": site_root,
-            "logo": {"@type": "ImageObject", "url": image_url},
-        },
-        {
-            "@context": "https://schema.org",
-            "@type": "WebSite",
-            "@id": f"{site_root}/#website",
-            "url": site_root,
-            "name": site_name,
-            "inLanguage": languages,
-            "publisher": {"@id": f"{site_root}/#organization"},
-        },
-        {
+    data = []
+
+    if is_homepage(rel_path):
+        data.extend(
+            [
+                {
+                    "@context": "https://schema.org",
+                    "@type": "Organization",
+                    "@id": f"{site_root}/#organization",
+                    "name": site_name,
+                    "alternateName": SITE_ALTERNATE_NAMES.get(site_name, []),
+                    "url": site_root,
+                    "description": homepage_description(site_name),
+                    "logo": {"@type": "ImageObject", "url": image_url},
+                    "sameAs": SITE_SAME_AS.get(site_name, []),
+                },
+                {
+                    "@context": "https://schema.org",
+                    "@type": "WebSite",
+                    "@id": f"{site_root}/#website",
+                    "url": site_root,
+                    "name": site_name,
+                    "alternateName": SITE_ALTERNATE_NAMES.get(site_name, []),
+                    "description": homepage_description(site_name),
+                    "inLanguage": languages,
+                    "publisher": {"@id": f"{site_root}/#organization"},
+                },
+            ]
+        )
+
+    data.extend(
+        [
+            {
             "@context": "https://schema.org",
             "@type": "WebPage",
             "@id": f"{current_url}#webpage",
             "url": current_url,
             "name": title,
             "description": description,
             "inLanguage": lang,
+            "dateModified": lastmod,
             "isPartOf": {"@id": f"{site_root}/#website"},
             "about": {"@id": f"{site_root}/#organization"},
             "primaryImageOfPage": {"@type": "ImageObject", "url": image_url},
-        },
-        {
+            },
+            {
             "@context": "https://schema.org",
             "@type": "BreadcrumbList",
             "itemListElement": [
@@ -268,24 +297,18 @@ def build_structured_data(site_url, lang, rel_path, title, description, site_nam
                 }
                 for index, item in enumerate(breadcrumb_items(site_url, lang, rel_path), start=1)
             ],
-        },
-    ]
-
-    if is_homepage(rel_path):
-        data[1]["potentialAction"] = {
-            "@type": "SearchAction",
-            "target": f"{website_url}?search={{search_term_string}}",
-            "query-input": "required name=search_term_string",
-        }
+            },
+        ]
+    )
 
     return data
 
 
-def build_seo_block(site_url, lang, rel_path, languages, default_lang, title, description, site_name):
+def build_seo_block(site_url, lang, rel_path, languages, default_lang, title, description, site_name, lastmod):
     current_url = canonical_url(site_url, lang, rel_path)
     image_url = social_image_url(site_url)
     structured_data = json.dumps(
-        build_structured_data(site_url, lang, rel_path, title, description, site_name, image_url, languages),
+        build_structured_data(site_url, lang, rel_path, title, description, site_name, image_url, languages, lastmod),
         ensure_ascii=False,
         separators=(",", ":"),
     )
@@ -335,13 +358,13 @@ def replace(match):
     return LANGUAGE_MENU_LINK_RE.sub(replace, document)
 
 
-def update_document(document, site_url, lang, rel_path, languages, default_lang, site_name):
+def update_document(document, site_url, lang, rel_path, languages, default_lang, site_name, lastmod):
     title_match = re.search(r"<title>(.*?)</title>", document, flags=re.I | re.S)
     page_title = clean_text(title_match.group(1)) if title_match else site_name
     fallback_description = f"{site_name}: {page_title}"
     description = homepage_description(site_name) if is_homepage(rel_path) else extract_description(document, fallback_description)
     seo_block = build_seo_block(
-        site_url, lang, rel_path, languages, default_lang, page_title, description, site_name
+        site_url, lang, rel_path, languages, default_lang, page_title, description, site_name, lastmod
     )
 
     document = re.sub(
@@ -457,6 +480,7 @@ def process_pages(args):
     for html_file in iter_html_files(book_dir):
         rel_path = html_file.relative_to(book_dir)
         content = html_file.read_text(encoding="utf-8")
+        lastmod = page_lastmod(book_dir, rel_path, html_file)
         updated = update_document(
             content,
             args.site_url,
@@ -465,6 +489,7 @@ def process_pages(args):
             languages,
             args.default_lang,
             args.site_name,
+            lastmod,
         )
         html_file.write_text(updated, encoding="utf-8")
 

src/pentesting-ci-cd/apache-airflow-security/README.md

@@ -62,13 +62,13 @@ If you have **access to the web console** you might be able to access some or al
 Variables can be stored in Airflow so the **DAGs** can **access** their values. It's similar to secrets of other platforms. If you have **enough permissions** you can access them in the GUI in `http://<airflow>/variable/list/`.\
 Airflow by default will show the value of the variable in the GUI, however, according to [**this**](https://marclamberti.com/blog/variables-with-apache-airflow/) it's possible to set a **list of variables** whose **value** will appear as **asterisks** in the **GUI**.
 
-![](<../../images/image (164).png>)
+![Airflow Variables page showing AWS_ACCESS_KEY_ID and a masked AWS_SECRET_ACCESS_KEY](<../../images/image (164).png>)
 
 However, these **values** can still be **retrieved** via **CLI** (you need to have DB access), **arbitrary DAG** execution, **API** accessing the variables endpoint (the API needs to be activated), and **even the GUI itself!**\
 To access those values from the GUI just **select the variables** you want to access and **click on Actions -> Export**.\
 Another way is to perform a **bruteforce** to the **hidden value** using the **search filtering** it until you get it:
 
-![](<../../images/image (152).png>)
+![Airflow Variables search filter returning the AWS_SECRET_ACCESS_KEY variable](<../../images/image (152).png>)
 
 #### Privilege Escalation
 

src/pentesting-ci-cd/atlantis-security.md

@@ -6,7 +6,7 @@
 
 Atlantis basically helps you to to run terraform from Pull Requests from your git server.
 
-![](<../images/image (161).png>)
+![Atlantis pull request workflow showing plan and apply comments in the PR lifecycle](<../images/image (161).png>)
 
 ### Local Lab
 
@@ -304,7 +304,7 @@ Moreover, if you don't have configured in the **branch protection** to ask to **
 
 This is the **setting** in Github branch protections:
 
-![](<../images/image (216).png>)
+![GitHub branch protection option to dismiss stale pull request approvals after new commits](<../images/image (216).png>)
 
 #### Webhook Secret
 

src/pentesting-ci-cd/circleci-security.md

@@ -70,7 +70,7 @@ jobs:
 These are **secrets** that are only going to be **accessible** by the **project** (by **any branch**).\
 You can see them **declared in** _https://app.circleci.com/settings/project/github/\<org_name>/\<repo_name>/environment-variables_
 
-![](<../images/image (129).png>)
+![CircleCI project environment variables page with MY_ENV_VAR and a masked secret value](<../images/image (129).png>)
 
 > [!CAUTION]
 > The "**Import Variables**" functionality allows to **import variables from other projects** to this one.
@@ -79,7 +79,7 @@ You can see them **declared in** _https://app.circleci.com/settings/project/gith
 
 These are secrets that are **org wide**. By **default any repo** is going to be able to **access any secret** stored here:
 
-![](<../images/image (123).png>)
+![CircleCI context security group page showing All members allowed to execute the context](<../images/image (123).png>)
 
 > [!TIP]
 > However, note that a different group (instead of All members) can be **selected to only give access to the secrets to specific people**.\

src/pentesting-ci-cd/concourse-security/concourse-architecture.md

@@ -10,7 +10,7 @@
 
 ### Architecture
 
-![](<../../images/image (187).png>)
+![Concourse architecture diagram with load balancer, ATC, TSA, Beacon, Garden, and Baggageclaim components](<../../images/image (187).png>)
 
 #### ATC: web UI & build scheduler
 

src/pentesting-ci-cd/gitea-security/README.md

@@ -6,7 +6,7 @@
 
 **Gitea** is a **self-hosted community managed lightweight code hosting** solution written in Go.
 
-![](<../../images/image (160).png>)
+![Gitea repository page showing files, branches, commits, tags, and repository statistics](<../../images/image (160).png>)
 
 ### Basic Information
 

src/pentesting-ci-cd/gitea-security/basic-gitea-information.md

@@ -34,7 +34,7 @@ When creating a new team, several important settings are selected:
   - **Administrator** access
   - **Specific** access:
 
-![](<../../images/image (118).png>)
+![Gitea organization repository permission matrix for owner, contributor, reader, and access roles](<../../images/image (118).png>)
 
 ### Teams & Users
 
@@ -66,7 +66,7 @@ You can generate personal access token to **give an application access to your a
 
 Just like personal access tokens **Oauth applications** will have **complete access** over your account and the places your account has access because, as indicated in the [docs](https://docs.gitea.io/en-us/oauth2-provider/#scopes), scopes aren't supported yet:
 
-![](<../../images/image (194).png>)
+![Gitea OAuth authorization prompt for TestApp requesting full account and organization access](<../../images/image (194).png>)
 
 ### Deploy keys
 

src/pentesting-ci-cd/jenkins-security/README.md

@@ -28,7 +28,7 @@ Without credentials you can look inside _**/asynchPeople/**_ path or _**/securit
 
 You may be able to get the Jenkins version from the path _**/oops**_ or _**/error**_
 
-![](<../../images/image (146).png>)
+![Jenkins Oops error page exposing the Jenkins version in the footer](<../../images/image (146).png>)
 
 ### Known Vulnerabilities
 
@@ -121,7 +121,7 @@ If the plugin reuses stored creds, Jenkins will attempt to authenticate to `atta
 
 If the compromised user has **enough privileges to create/modify a new Jenkins node** and SSH credentials are already stored to access other nodes, he could **steal those credentials** by creating/modifying a node and **setting a host that will record the credentials** without verifying the host key:
 
-![](<../../images/image (218).png>)
+![Jenkins node configuration form with host, credentials, and non-verifying host key strategy fields](<../../images/image (218).png>)
 
 You will usually find Jenkins ssh credentials in a **global provider** (`/credentials/`), so you can also dump them as you would dump any other secret. More information in the [**Dumping secrets section**](#dumping-secrets).
 
@@ -163,7 +163,7 @@ To exploit pipelines you still need to have access to Jenkins.
 
 **Pipelines** can also be used as **build mechanism in projects**, in that case it can be configured a **file inside the repository** that will contains the pipeline syntax. By default `/Jenkinsfile` is used:
 
-![](<../../images/image (127).png>)
+![Jenkins pipeline build configuration using Jenkinsfile mode and script path](<../../images/image (127).png>)
 
 It's also possible to **store pipeline configuration files in other places** (in other repositories for example) with the goal of **separating** the repository **access** and the pipeline access.
 
@@ -278,7 +278,7 @@ basic-jenkins-information.md
 
 You can enumerate the **configured nodes** in `/computer/`, you will usually find the \*\*`Built-In Node` \*\* (which is the node running Jenkins) and potentially more:
 
-![](<../../images/image (249).png>)
+![Jenkins node list showing agent1 and Built-In Node executors](<../../images/image (249).png>)
 
 It is **specially interesting to compromise the Built-In node** because it contains sensitive Jenkins information.
 
@@ -358,7 +358,7 @@ You can list the secrets accessing `/credentials/` if you have enough permission
 
 If you can **see the configuration of each project**, you can also see in there the **names of the credentials (secrets)** being use to access the repository and **other credentials of the project**.
 
-![](<../../images/image (180).png>)
+![Jenkins credentials selector showing gitea-access-token and Add credential button](<../../images/image (180).png>)
 
 #### From Groovy
 

src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md

@@ -33,7 +33,7 @@ In `/configureSecurity` it's possible to **configure the authorization method of
 - **Logged-in users can do anything**: In this mode, every **logged-in user gets full control** of Jenkins. The only user who won't have full control is **anonymous user**, who only gets **read access**.
 - **Matrix-based security**: You can configure **who can do what** in a table. Each **column** represents a **permission**. Each **row** **represents** a **user or a group/role.** This includes a special user '**anonymous**', which represents **unauthenticated users**, as well as '**authenticated**', which represents **all authenticated users**.
 
-![](<../../images/image (149).png>)
+![Jenkins matrix-based authorization table with permissions columns for users and groups](<../../images/image (149).png>)
 
 - **Project-based Matrix Authorization Strategy:** This mode is an **extension** to "**Matrix-based security**" that allows additional ACL matrix to be **defined for each project separately.**
 - **Role-Based Strategy:** Enables defining authorizations using a **role-based strategy**. Manage the roles in `/role-strategy`.

src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md

@@ -6,11 +6,11 @@
 
 In "New Item" (accessible in `/view/all/newJob`) select **Pipeline:**
 
-![](<../../images/image (235).png>)
+![Jenkins New Item page with Pipeline selected as the project type](<../../images/image (235).png>)
 
 In the **Pipeline section** write the **reverse shell**:
 
-![](<../../images/image (285).png>)
+![Jenkins Pipeline script editor containing a Groovy reverse shell payload](<../../images/image (285).png>)
 
 ```groovy
 pipeline {
@@ -30,7 +30,7 @@ pipeline {
 
 Finally click on **Save**, and **Build Now** and the pipeline will be executed:
 
-![](<../../images/image (228).png>)
+![Jenkins build console showing a reverse shell connection and whoami output](<../../images/image (228).png>)
 
 ## Modifying a Pipeline