Downloads to Disk

Downloads to Disk

--download enables artifact/content collection for modules that support it.

Common Download Workflow

modules run enum_all --iam --download

For targeted collection:

modules run enum_cloudstorage --download
modules run enum_secretsmanager --download
modules run enum_cloudfunctions --download

Cloud Logging Downloads (capped per log)

By default enum_logging only lists the log "groups" (sinks with their export destinations + writer SAs, buckets, log names, and metrics). Pass --download to pull recent log entries to JSON. To keep projects with many logs bounded, downloads are capped per log by --download-limit (default 1000):

modules run enum_logging --download
modules run enum_logging --download --download-limit 250
modules run enum_logging --download --logs cloudaudit.googleapis.com/activity,cloudaudit.googleapis.com/data_access
modules run enum_logging --download --output ./exports/logs

• --logs limits the download to a comma-separated set of log names (default: all discovered logs).
• --output overrides the output directory for the downloaded entry files.
• Without --logs, every discovered log is fetched, each independently capped at --download-limit entries.

enum_all Download Token Scoping

--download on enum_all takes a comma-separated list whose values are EITHER a category keyword (runs that whole group) OR an individual token (that one download). There are no aliases — each download has exactly one canonical token (listed below); an unrecognized value errors and prints the full accepted set.

modules run enum_all --download                       # bare flag == "all"
modules run enum_all --download metadata              # the whole metadata group
modules run enum_all --download content               # the whole content group
modules run enum_all --download buckets,secrets,bigquery_tables   # individual tokens
modules run enum_all --download compute_artifacts     # explicit-only (see note)
modules run enum_all --download --dont-download buckets,secrets   # all-except

Capping Download Time (--download-timeout)

Some download types are unbounded in wall-clock time — a bucket with thousands of blobs, a chatty secret set, or serial-port logs can run far longer than the rest of the enumeration. --download-timeout <seconds> puts a per-unit wall-clock cap on downloads so one slow target can't stall the whole run. When a unit exceeds the budget, gcpwn prints a one-time notice, skips the remainder of that unit, and moves on to the next one. 0/unset (the default) means unlimited.

The "unit" the clock resets against depends on the service:

• Cloud Storage — the budget is per bucket. Each bucket gets its own fresh <seconds>; hitting the cap on one bucket skips that bucket's remaining blobs but the next bucket starts with a full budget. (A fast bucket is never penalized for a slow one.)
• Every other download type (secrets, function sources, BigQuery table data, serial output, screenshots, compute artifacts, Cloud Build logs, Composer configs, Cloud Run revision env, Cloud Tasks requests, Firestore data, Artifact Registry files, Batch scripts, API-key content, log entries, …) — the budget is per download type, per project. The clock resets for each type, so a slow type doesn't eat another type's time.

# Give every download type (and every bucket) at most 120s before moving on
modules run enum_all --download --download-timeout 120

# Scope the downloads AND time-box them: metadata group, 30s per type
modules run enum_all --download metadata --download-timeout 30

# Content downloads, but no single bucket may run longer than 60s
modules run enum_all --download content --download-timeout 60

--download-timeout is a top-level enum_all flag: set it once and it applies to every download type the run touches (it is propagated to per-service downloads via the session). enum_gcp accepts the same flag. It composes with --download/--dont-download scoping and with per-service caps like Cloud Logging's --download-limit.

Google Drive Content (--download-google-drive)

Google Drive is a Workspace data plane, not a GCP per-project download — so it is not part of the --download categories below and is never pulled by the GCP download tokens. Because a full Drive content sweep is heavy and noisy, it is a separate, explicit opt-in:

modules run enum_all --download-google-drive        # adds a Workspace-phase enum_drive --all-users --download

When set, enum_all's trailing Google Workspace phase runs enum_drive --all-users --download (lists AND downloads Drive file content for every cached user). Omit it and no Drive files are touched. For finer control (public-only, exposure/owner filters, secret-scan, or downloading as a specific credential) run enum_drive directly — see its module page.

Download Token Categories

The three category keywords: all (everything in both groups below), metadata, and content.

Category	Tokens
metadata	function_env, cloudbuild_builds, composer_configs, cloudtasks_requests, cloudrun_revision_env, clouddns_record_sets
content	buckets, function_source, secrets, firestore_data, bigquery_tables, compute_serial, compute_screenshot, artifactregistry_files, batch_scripts, apikeys_content
explicit-only	compute_artifacts — a heavy full compute-instance artifact dump, intentionally excluded from all/content; request it by name to run it.

Output Location

Downloads are written under:

./gcpwn_output/<workspace_id>_<workspace_name_slug>/downloads/

GCPwn builds download paths from the current working directory (Path.cwd()), then appends:

downloads/<service_name>/<project_id_or_global>/<optional_subdirs>/<filename>

Folder Layout (What You Will See)

gcpwn_output/
└── <workspace_id>_<workspace_name_slug>/
    └── downloads/
        ├── storage/
        │   └── <project_id>/
        ├── cloudfunctions/
        │   └── <project_id>/function_sources/
        ├── secretmanager/
        │   └── <project_id>/
        ├── bigquery/
        │   └── <project_id>/tables/
        ├── cloudrun/
        │   └── <project_id>/revisions/
        ├── compute/
        │   └── <project_id>/
        └── ...

Common Download Paths by Token

Token (from enum_all --download ...)	Typical service folder	Typical path pattern
buckets	storage	.../downloads/storage/<project_id>/<bucket>/<object_path>
function_source	cloudfunctions	.../downloads/cloudfunctions/<project_id>/function_sources/<function>_<gen>_source.zip
function_env	cloudfunctions	.../downloads/cloudfunctions/<project_id>/...
secrets	secretmanager	.../downloads/secretmanager/<project_id>/<secret>_<version>_value.txt
firestore_data	firestore	.../downloads/firestore/<project_id>/collections/...
bigquery_tables	bigquery	.../downloads/bigquery/<project_id>/tables/<project_dataset>/<table>.jsonl
compute_serial	compute	.../downloads/compute/<project_id>/serial/...
compute_screenshot	compute	.../downloads/compute/<project_id>/screenshots/...
artifactregistry_files	artifactregistry	.../downloads/artifactregistry/<project_id>/Files/...
batch_scripts	batch	.../downloads/batch/<project_id>/...
apikeys_content	apikeys	.../downloads/apikeys/<project_id>/keys/api_key_<id>.txt
cloudrun_revision_env	cloudrun	.../downloads/cloudrun/<project_id>/revisions/..._env.yaml
cloudtasks_requests	cloudtasks	.../downloads/cloudtasks/<project_id>/...
clouddns_record_sets	clouddns	.../downloads/clouddns/<project_id>/...
cloudbuild_builds	cloudbuild	.../downloads/cloudbuild/<project_id>/...
composer_configs	cloudcomposer	.../downloads/cloudcomposer/<project_id>/...

Notes

• Some modules let you override output location with module-specific flags (for example --output on some modules).
• If a module cannot resolve a project context, it may use global instead of a project ID in the path.
• Folder names are normalized/sanitized automatically (workspace name, service name, and filenames).

Useful Companion Exports

After downloads:

data export csv
data export json
data export excel

This gives table data plus downloaded artifacts for reporting.