From b66a8cf1e495f26100cdaedc01b045dc0bf845fd Mon Sep 17 00:00:00 2001
From: HackTricks News Bot <bot@hacktricks.xyz>
Date: Mon, 17 Aug 2026 18:43:24 +0000
Subject: [PATCH] Add content from: Critical Unauthenticated Remote Code
 Execution in CircleCI's...

---
 ...ower-awx-automation-controller-security.md |  2 ++
 .../apache-airflow-security/README.md         |  3 ++-
 .../airflow-configuration.md                  |  2 ++
 .../apache-airflow-security/airflow-rbac.md   |  3 ++-
 src/pentesting-ci-cd/argocd-security.md       |  2 ++
 src/pentesting-ci-cd/atlantis-security.md     |  3 ++-
 .../chef-automate-security/README.md          |  2 ++
 .../chef-automate-enumeration-and-attacks.md  |  2 ++
 src/pentesting-ci-cd/circleci-security.md     | 26 ++++++++++++++++++-
 .../cloudflare-security/README.md             |  2 ++
 .../cloudflare-security/cloudflare-domains.md |  3 ++-
 ...-workers-pass-through-proxy-ip-rotation.md |  2 ++
 .../cloudflare-zero-trust-network.md          |  2 ++
 .../concourse-security/README.md              |  3 ++-
 .../concourse-architecture.md                 |  3 ++-
 .../concourse-enumeration-and-attacks.md      |  2 ++
 .../concourse-lab-creation.md                 |  3 ++-
 .../docker-build-context-abuse.md             |  2 ++
 .../gitblit-security/README.md                |  2 ++
 ...embedded-ssh-auth-bypass-cve-2024-28080.md |  3 ++-
 src/pentesting-ci-cd/gitea-security/README.md |  3 ++-
 .../gitea-security/basic-gitea-information.md |  2 ++
 .../github-security/README.md                 |  3 ++-
 .../abusing-github-actions/README.md          |  3 ++-
 .../gh-actions-artifact-poisoning.md          |  3 ++-
 .../gh-actions-cache-poisoning.md             |  2 ++
 .../gh-actions-context-script-injections.md   |  2 ++
 .../gh-actions-npm-supply-chain-abuse.md      |  2 ++
 .../accessible-deleted-data-in-github.md      |  3 ++-
 .../basic-github-information.md               |  3 ++-
 src/pentesting-ci-cd/gogs-security/README.md  |  2 ++
 .../jenkins-security/README.md                |  3 ++-
 .../basic-jenkins-information.md              |  2 ++
 ...itrary-file-read-to-rce-via-remember-me.md |  3 ++-
 .../jenkins-dumping-secrets-from-groovy.md    |  3 ++-
 ...jenkins-rce-creating-modifying-pipeline.md |  3 ++-
 .../jenkins-rce-creating-modifying-project.md |  2 ++
 .../jenkins-rce-with-groovy-script.md         |  3 ++-
 src/pentesting-ci-cd/okta-security/README.md  |  2 ++
 .../okta-security/okta-hardening.md           |  3 ++-
 .../pentesting-ci-cd-methodology.md           |  2 ++
 .../serverless.com-security.md                |  3 ++-
 src/pentesting-ci-cd/supabase-security.md     |  3 ++-
 .../teamcity-security/README.md               |  2 ++
 src/pentesting-ci-cd/terraform-security.md    |  3 ++-
 src/pentesting-ci-cd/todo.md                  |  3 ++-
 .../travisci-security/README.md               |  3 ++-
 .../basic-travisci-information.md             |  2 ++
 src/pentesting-ci-cd/vercel-security.md       |  2 ++
 src/pentesting-cloud/aws-security/README.md   |  3 ++-
 .../aws-basic-information/README.md           |  3 ++-
 .../aws-federation-abuse.md                   |  3 ++-
 .../aws-permissions-for-a-pentest.md          |  3 ++-
 .../aws-security/aws-persistence/README.md    |  3 ++-
 .../aws-api-gateway-persistence/README.md     |  3 ++-
 .../aws-cloudformation-persistence/README.md  |  3 ++-
 .../aws-cognito-persistence/README.md         |  3 ++-
 .../aws-dynamodb-persistence/README.md        |  3 ++-
 .../aws-ec2-persistence/README.md             |  3 ++-
 .../README.md                                 |  3 ++-
 .../aws-ecr-persistence/README.md             |  3 ++-
 .../aws-ecs-persistence/README.md             |  3 ++-
 .../aws-efs-persistence/README.md             |  3 ++-
 .../README.md                                 |  3 ++-
 .../aws-iam-persistence/README.md             |  3 ++-
 .../aws-kms-persistence/README.md             |  3 ++-
 .../aws-lambda-persistence/README.md          |  3 ++-
 .../aws-abusing-lambda-extensions.md          |  3 ++-
 ...ws-lambda-alias-version-policy-backdoor.md |  3 ++-
 .../aws-lambda-async-self-loop-persistence.md |  3 ++-
 .../aws-lambda-exec-wrapper-persistence.md    |  3 ++-
 .../aws-lambda-layers-persistence.md          |  3 ++-
 .../aws-lightsail-persistence/README.md       |  3 ++-
 .../aws-rds-persistence/README.md             |  3 ++-
 .../aws-s3-persistence/README.md              |  3 ++-
 .../aws-sagemaker-persistence/README.md       |  3 ++-
 .../aws-secrets-manager-persistence/README.md |  3 ++-
 .../aws-sns-persistence/README.md             |  3 ++-
 .../aws-sqs-persistence/README.md             |  3 ++-
 .../aws-sqs-dlq-backdoor-persistence.md       |  3 ++-
 .../aws-sqs-orgid-policy-backdoor.md          |  2 ++
 .../aws-ssm-persistence/README.md             |  3 ++-
 .../aws-step-functions-persistence/README.md  |  2 ++
 .../aws-sts-persistence/README.md             |  2 ++
 .../aws-post-exploitation/README.md           |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-bedrock-post-exploitation/README.md   |  2 ++
 .../README.md                                 |  3 ++-
 .../aws-codebuild-post-exploitation/README.md |  3 ++-
 .../aws-codebuild-token-leakage.md            |  2 ++
 ...s-codebuild-untrusted-pr-webhook-bypass.md |  2 ++
 .../README.md                                 |  3 ++-
 .../aws-dlm-post-exploitation/README.md       |  3 ++-
 .../aws-dynamodb-post-exploitation/README.md  |  2 ++
 .../README.md                                 |  2 ++
 .../aws-ami-store-s3-exfiltration.md          |  2 ++
 .../aws-ebs-multi-attach-data-theft.md        |  2 ++
 .../aws-ebs-snapshot-dump.md                  |  3 ++-
 ...-ec2-instance-connect-endpoint-backdoor.md |  2 ++
 .../aws-eip-hijack-impersonation.md           |  2 ++
 .../aws-eni-secondary-ip-hijack.md            |  2 ++
 .../aws-malicious-vpc-mirror.md               |  2 ++
 .../aws-managed-prefix-list-backdoor.md       |  2 ++
 .../aws-vpc-endpoint-egress-bypass.md         |  2 ++
 ...pc-flow-logs-cross-account-exfiltration.md |  2 ++
 .../aws-ecr-post-exploitation/README.md       |  2 ++
 .../aws-ecs-post-exploitation/README.md       |  2 ++
 .../aws-efs-post-exploitation/README.md       |  3 ++-
 .../aws-eks-post-exploitation/README.md       |  2 ++
 .../README.md                                 |  3 ++-
 .../aws-iam-post-exploitation/README.md       |  2 ++
 .../aws-kms-post-exploitation/README.md       |  2 ++
 .../aws-lambda-post-exploitation/README.md    |  2 ++
 .../aws-lambda-efs-mount-injection.md         |  2 ++
 .../aws-lambda-event-source-mapping-hijack.md |  2 ++
 ...aws-lambda-function-url-public-exposure.md |  2 ++
 .../aws-lambda-loggingconfig-redirection.md   |  2 ++
 .../aws-lambda-runtime-pinning-abuse.md       |  2 ++
 .../aws-lambda-vpc-egress-bypass.md           |  2 ++
 .../aws-warm-lambda-persistence.md            |  2 ++
 .../aws-lightsail-post-exploitation/README.md |  3 ++-
 .../aws-mwaa-post-exploitation/README.md      |  2 ++
 .../README.md                                 |  3 ++-
 .../aws-rds-post-exploitation/README.md       |  2 ++
 .../aws-s3-post-exploitation/README.md        |  2 ++
 .../aws-sagemaker-post-exploitation/README.md |  2 ++
 .../feature-store-poisoning.md                |  2 ++
 .../README.md                                 |  2 ++
 .../aws-ses-post-exploitation/README.md       |  3 ++-
 .../aws-sns-post-exploitation/README.md       |  2 ++
 .../aws-sns-data-protection-bypass.md         |  2 ++
 .../aws-sns-fifo-replay-exfil.md              |  2 ++
 .../aws-sns-firehose-exfil.md                 |  2 ++
 .../aws-sqs-post-exploitation/README.md       |  2 ++
 .../aws-sqs-dlq-redrive-exfiltration.md       |  2 ++
 .../aws-sqs-sns-injection.md                  |  2 ++
 .../README.md                                 |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-sts-post-exploitation/README.md       |  2 ++
 .../aws-vpn-post-exploitation/README.md       |  3 ++-
 .../aws-workmail-post-exploitation/README.md  |  2 ++
 .../aws-privilege-escalation/README.md        |  3 ++-
 .../aws-apigateway-privesc/README.md          |  2 ++
 .../aws-apprunner-privesc/README.md           |  2 ++
 .../aws-bedrock-privesc/README.md             |  2 ++
 .../aws-chime-privesc/README.md               |  3 ++-
 .../aws-cloudformation-privesc/README.md      |  3 ++-
 ...stack-and-cloudformation-describestacks.md |  2 ++
 .../aws-cloudfront-privesc/README.md          |  2 ++
 .../aws-codebuild-privesc/README.md           |  2 ++
 .../aws-codepipeline-privesc/README.md        |  3 ++-
 .../aws-codestar-privesc/README.md            |  2 ++
 ...ateproject-codestar-associateteammember.md |  2 ++
 .../iam-passrole-codestar-createproject.md    |  2 ++
 .../aws-cognito-privesc/README.md             |  2 ++
 .../aws-datapipeline-privesc/README.md        |  2 ++
 .../aws-directory-services-privesc/README.md  |  3 ++-
 .../aws-dynamodb-privesc/README.md            |  3 ++-
 .../aws-ebs-privesc/README.md                 |  2 ++
 .../aws-ec2-privesc/README.md                 |  2 ++
 .../aws-ecr-privesc/README.md                 |  2 ++
 .../aws-ecs-privesc/README.md                 |  2 ++
 .../aws-efs-privesc/README.md                 |  2 ++
 .../aws-elastic-beanstalk-privesc/README.md   |  2 ++
 .../aws-emr-privesc/README.md                 |  2 ++
 .../aws-gamelift/README.md                    |  3 ++-
 .../aws-glue-privesc/README.md                |  3 ++-
 .../aws-iam-privesc/README.md                 |  2 ++
 .../aws-kms-privesc/README.md                 |  3 ++-
 .../aws-lambda-privesc/README.md              |  2 ++
 .../aws-lightsail-privesc/README.md           |  2 ++
 .../aws-macie-privesc/README.md               |  2 ++
 .../aws-mediapackage-privesc/README.md        |  3 ++-
 .../aws-mq-privesc/README.md                  |  2 ++
 .../aws-msk-privesc/README.md                 |  2 ++
 .../aws-organizations-prinvesc/README.md      |  3 ++-
 .../aws-rds-privesc/README.md                 |  2 ++
 .../aws-redshift-privesc/README.md            |  2 ++
 .../aws-s3-privesc/README.md                  |  2 ++
 .../aws-sagemaker-privesc/README.md           |  4 ++-
 .../aws-secrets-manager-privesc/README.md     |  2 ++
 .../aws-sns-privesc/README.md                 |  2 ++
 .../aws-sqs-privesc/README.md                 |  3 ++-
 .../aws-ssm-privesc/README.md                 |  2 ++
 .../README.md                                 |  2 ++
 .../aws-stepfunctions-privesc/README.md       |  2 ++
 .../aws-sts-privesc/README.md                 |  2 ++
 .../aws-workdocs-privesc/README.md            |  2 ++
 .../eventbridgescheduler-privesc/README.md    |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-security/aws-services/README.md       |  2 ++
 .../aws-services/aws-api-gateway-enum.md      |  2 ++
 .../aws-services/aws-bedrock-enum.md          |  2 ++
 ...m-and-private-certificate-authority-pca.md |  2 ++
 .../aws-cloudformation-and-codestar-enum.md   |  3 ++-
 .../aws-services/aws-cloudfront-enum.md       |  3 ++-
 .../aws-services/aws-cloudhsm-enum.md         |  2 ++
 .../aws-services/aws-codebuild-enum.md        |  2 ++
 .../aws-services/aws-cognito-enum/README.md   |  3 ++-
 .../cognito-identity-pools.md                 |  2 ++
 .../aws-cognito-enum/cognito-user-pools.md    |  2 ++
 ...e-codepipeline-codebuild-and-codecommit.md |  2 ++
 .../aws-directory-services-workdocs-enum.md   |  2 ++
 .../aws-documentdb-enum/README.md             |  2 ++
 .../aws-services/aws-dynamodb-enum.md         |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-nitro-enum.md                         |  2 ++
 ...ws-vpc-and-networking-basic-information.md |  2 ++
 .../aws-security/aws-services/aws-ecr-enum.md |  2 ++
 .../aws-security/aws-services/aws-ecs-enum.md |  2 ++
 .../aws-security/aws-services/aws-efs-enum.md |  2 ++
 .../aws-security/aws-services/aws-eks-enum.md |  2 ++
 .../aws-elastic-beanstalk-enum.md             |  2 ++
 .../aws-services/aws-elasticache.md           |  2 ++
 .../aws-security/aws-services/aws-emr-enum.md |  2 ++
 .../aws-security/aws-services/aws-iam-enum.md |  2 ++
 .../aws-kinesis-data-firehose-enum.md         |  2 ++
 .../aws-security/aws-services/aws-kms-enum.md |  2 ++
 .../aws-services/aws-lambda-enum.md           |  3 ++-
 .../aws-services/aws-lightsail-enum.md        |  2 ++
 .../aws-services/aws-macie-enum.md            |  2 ++
 .../aws-security/aws-services/aws-mq-enum.md  |  3 ++-
 .../aws-security/aws-services/aws-msk-enum.md |  2 ++
 .../aws-services/aws-organizations-enum.md    |  3 ++-
 .../aws-services/aws-other-services-enum.md   |  2 ++
 .../aws-services/aws-redshift-enum.md         |  2 ++
 .../aws-relational-database-rds-enum.md       |  2 ++
 .../aws-services/aws-route53-enum.md          |  2 ++
 .../aws-s3-athena-and-glacier-enum.md         |  2 ++
 .../aws-services/aws-sagemaker-enum/README.md |  2 ++
 .../aws-services/aws-secrets-manager-enum.md  |  2 ++
 .../README.md                                 |  3 ++-
 .../aws-cloudtrail-enum.md                    |  2 ++
 .../aws-cloudwatch-enum.md                    |  3 ++-
 .../aws-config-enum.md                        |  2 ++
 .../aws-control-tower-enum.md                 |  3 ++-
 .../aws-cost-explorer-enum.md                 |  3 ++-
 .../aws-detective-enum.md                     |  3 ++-
 .../aws-firewall-manager-enum.md              |  3 ++-
 .../aws-guardduty-enum.md                     |  2 ++
 .../aws-inspector-enum.md                     |  3 ++-
 .../aws-security-hub-enum.md                  |  3 ++-
 .../aws-shield-enum.md                        |  2 ++
 .../aws-trusted-advisor-enum.md               |  3 ++-
 .../aws-waf-enum.md                           |  3 ++-
 .../aws-security/aws-services/aws-ses-enum.md |  3 ++-
 .../aws-security/aws-services/aws-sns-enum.md |  2 ++
 .../aws-services/aws-sqs-and-sns-enum.md      |  2 ++
 .../aws-services/aws-stepfunctions-enum.md    |  2 ++
 .../aws-security/aws-services/aws-sts-enum.md |  2 ++
 .../aws-services/eventbridgescheduler-enum.md |  2 ++
 .../aws-unauthenticated-enum-access/README.md |  2 ++
 .../README.md                                 |  3 ++-
 .../README.md                                 |  2 ++
 .../README.md                                 |  2 ++
 .../README.md                                 |  3 ++-
 .../README.md                                 |  3 ++-
 .../aws-documentdb-enum/README.md             |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-ec2-unauthenticated-enum/README.md    |  3 ++-
 .../aws-ecr-unauthenticated-enum/README.md    |  2 ++
 .../aws-ecs-unauthenticated-enum/README.md    |  3 ++-
 .../README.md                                 |  3 ++-
 .../README.md                                 |  2 ++
 .../README.md                                 |  3 ++-
 .../README.md                                 |  3 ++-
 .../aws-iot-unauthenticated-enum/README.md    |  2 ++
 .../README.md                                 |  2 ++
 .../README.md                                 |  2 ++
 .../aws-media-unauthenticated-enum/README.md  |  2 ++
 .../aws-mq-unauthenticated-enum/README.md     |  3 ++-
 .../aws-msk-unauthenticated-enum/README.md    |  2 ++
 .../aws-rds-unauthenticated-enum/README.md    |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-s3-unauthenticated-enum/README.md     |  3 ++-
 .../README.md                                 |  2 ++
 .../aws-sns-unauthenticated-enum/README.md    |  2 ++
 .../aws-sqs-unauthenticated-enum/README.md    |  3 ++-
 src/pentesting-cloud/azure-security/README.md |  2 ++
 .../az-basic-information/README.md            |  3 ++-
 .../az-federation-abuse.md                    |  2 ++
 .../az-tokens-and-public-applications.md      |  2 ++
 .../azure-security/az-device-registration.md  |  2 ++
 .../azure-security/az-enumeration-tools.md    |  2 ++
 .../README.md                                 |  2 ++
 .../az-arc-vulnerable-gpo-deploy-script.md    |  2 ++
 .../az-cloud-kerberos-trust.md                |  2 ++
 .../az-cloud-sync.md                          |  2 ++
 .../az-connect-sync.md                        |  3 ++-
 .../az-domain-services.md                     |  2 ++
 .../az-exchange-hybrid-impersonation.md       |  2 ++
 .../az-federation.md                          |  2 ++
 .../az-hybrid-identity-misc-attacks.md        |  3 ++-
 .../az-local-cloud-credentials.md             |  2 ++
 .../az-pass-the-certificate.md                |  2 ++
 .../az-pass-the-cookie.md                     |  2 ++
 .../az-primary-refresh-token-prt.md           |  2 ++
 .../az-pta-pass-through-authentication.md     |  2 ++
 .../az-seamless-sso.md                        |  3 ++-
 .../az-permissions-for-a-pentest.md           |  2 ++
 .../azure-security/az-persistence/README.md   |  2 ++
 .../az-automation-accounts-persistence.md     |  2 ++
 .../az-cloud-shell-persistence.md             |  2 ++
 .../az-logic-apps-persistence.md              |  2 ++
 .../az-persistence/az-queue-persistence.md    |  2 ++
 .../az-persistence/az-sql-persistence.md      |  2 ++
 .../az-persistence/az-storage-persistence.md  |  2 ++
 .../az-persistence/az-vms-persistence.md      |  3 ++-
 .../az-post-exploitation/README.md            |  2 ++
 .../az-api-management-post-exploitation.md    |  2 ++
 .../az-azure-ai-foundry-post-exploitation.md  |  2 ++
 .../az-blob-storage-post-exploitation.md      |  2 ++
 ...az-container-registry-post-exploitation.md |  2 ++
 .../az-cosmosDB-post-exploitation.md          |  2 ++
 .../az-file-share-post-exploitation.md        |  2 ++
 .../az-function-apps-post-exploitation.md     |  2 ++
 .../az-key-vault-post-exploitation.md         |  2 ++
 .../az-logic-apps-post-exploitation.md        |  2 ++
 .../az-mysql-post-exploitation.md             |  2 ++
 .../az-postgresql-post-exploitation.md        |  2 ++
 .../az-queue-post-exploitation.md             |  2 ++
 .../az-servicebus-post-exploitation.md        |  3 ++-
 .../az-sql-post-exploitation.md               |  2 ++
 .../az-table-storage-post-exploitation.md     |  2 ++
 .../az-virtual-desktop-post-exploitation.md   |  2 ++
 .../az-vms-and-network-post-exploitation.md   |  2 ++
 .../az-privilege-escalation/README.md         |  3 ++-
 .../az-ai-foundry-privesc.md                  |  3 ++-
 .../az-api-management-privesc.md              |  2 ++
 .../az-app-services-privesc.md                |  2 ++
 .../az-authorization-privesc.md               |  2 ++
 .../az-automation-accounts-privesc.md         |  2 ++
 ...z-container-instances-apps-jobs-privesc.md |  2 ++
 .../az-container-registry-privesc.md          |  2 ++
 .../az-cosmosDB-privesc.md                    |  2 ++
 .../az-entraid-privesc/README.md              |  3 ++-
 ...-conditional-access-policies-mfa-bypass.md |  2 ++
 .../az-entraid-privesc/dynamic-groups.md      |  2 ++
 .../az-functions-app-privesc.md               |  3 ++-
 .../az-key-vault-privesc.md                   |  2 ++
 .../az-logic-apps-privesc.md                  |  2 ++
 .../az-mysql-privesc.md                       |  2 ++
 .../az-postgresql-privesc.md                  |  2 ++
 .../az-queue-privesc.md                       |  2 ++
 .../az-servicebus-privesc.md                  |  2 ++
 .../az-privilege-escalation/az-sql-privesc.md |  2 ++
 .../az-static-web-apps-privesc.md             |  2 ++
 .../az-storage-privesc.md                     |  2 ++
 .../az-virtual-desktop-privesc.md             |  2 ++
 ...az-virtual-machines-and-network-privesc.md |  2 ++
 .../azure-security/az-services/README.md      |  2 ++
 .../azure-security/az-services/az-acr.md      |  3 ++-
 .../az-services/az-ai-foundry.md              |  2 ++
 .../az-services/az-api-management.md          |  2 ++
 .../az-services/az-app-services.md            |  2 ++
 .../az-services/az-application-proxy.md       |  2 ++
 .../az-services/az-arm-templates.md           |  2 ++
 .../az-services/az-automation-accounts.md     |  2 ++
 .../azure-security/az-services/az-azuread.md  |  2 ++
 .../az-services/az-cloud-shell.md             |  3 ++-
 .../az-container-instances-apps-jobs.md       |  2 ++
 .../az-services/az-container-registry.md      |  2 ++
 .../azure-security/az-services/az-cosmosDB.md |  2 ++
 .../azure-security/az-services/az-defender.md |  2 ++
 .../az-services/az-file-shares.md             |  2 ++
 .../az-services/az-front-door.md              |  2 ++
 .../az-services/az-function-apps.md           |  2 ++
 .../azure-security/az-services/az-keyvault.md |  2 ++
 .../az-services/az-logic-apps.md              |  2 ++
 ...roups-subscriptions-and-resource-groups.md |  3 ++-
 .../azure-security/az-services/az-misc.md     |  2 ++
 .../az-services/az-monitoring.md              |  2 ++
 .../azure-security/az-services/az-mysql.md    |  2 ++
 .../az-services/az-postgresql.md              |  2 ++
 .../azure-security/az-services/az-queue.md    |  3 ++-
 .../azure-security/az-services/az-sentinel.md |  2 ++
 .../az-services/az-servicebus.md              |  2 ++
 .../azure-security/az-services/az-sql.md      |  2 ++
 .../az-services/az-static-web-apps.md         |  2 ++
 .../azure-security/az-services/az-storage.md  |  2 ++
 .../az-services/az-table-storage.md           |  2 ++
 .../az-services/az-virtual-desktop.md         |  2 ++
 .../azure-security/az-services/intune.md      |  2 ++
 .../azure-security/az-services/vms/README.md  |  2 ++
 .../az-services/vms/az-azure-network.md       |  2 ++
 .../README.md                                 |  2 ++
 .../az-container-registry-unauth.md           |  2 ++
 .../az-device-code-authentication-phishing.md |  2 ++
 .../az-monitor-alert-phishing.md              |  2 ++
 .../az-oauth-apps-phishing.md                 |  2 ++
 .../az-password-spraying.md                   |  2 ++
 .../az-storage-unauth.md                      |  2 ++
 .../az-vms-unauth.md                          |  3 ++-
 ...2-header-malleability-null-cipher-abuse.md |  2 ++
 .../digital-ocean-pentesting/README.md        |  3 ++-
 .../do-basic-information.md                   |  2 ++
 .../do-permissions-for-a-pentest.md           |  2 ++
 .../do-services/README.md                     |  2 ++
 .../do-services/do-apps.md                    |  2 ++
 .../do-services/do-container-registry.md      |  3 ++-
 .../do-services/do-databases.md               |  2 ++
 .../do-services/do-droplets.md                |  2 ++
 .../do-services/do-functions.md               |  2 ++
 .../do-services/do-images.md                  |  2 ++
 .../do-services/do-kubernetes-doks.md         |  2 ++
 .../do-services/do-networking.md              |  2 ++
 .../do-services/do-projects.md                |  2 ++
 .../do-services/do-spaces.md                  |  2 ++
 .../do-services/do-volumes.md                 |  3 ++-
 src/pentesting-cloud/gcp-security/README.md   |  2 ++
 .../gcp-basic-information/README.md           |  2 ++
 .../gcp-federation-abuse.md                   |  2 ++
 .../gcp-permissions-for-a-pentest.md          |  2 ++
 .../gcp-security/gcp-persistence/README.md    |  3 ++-
 .../gcp-api-keys-persistence.md               |  2 ++
 .../gcp-app-engine-persistence.md             |  3 ++-
 .../gcp-artifact-registry-persistence.md      |  2 ++
 .../gcp-bigquery-persistence.md               |  2 ++
 .../gcp-bigtable-persistence.md               |  2 ++
 .../gcp-cloud-functions-persistence.md        |  3 ++-
 .../gcp-cloud-run-persistence.md              |  2 ++
 .../gcp-cloud-shell-persistence.md            |  3 ++-
 .../gcp-cloud-sql-persistence.md              |  2 ++
 .../gcp-compute-persistence.md                |  2 ++
 .../gcp-dataflow-persistence.md               |  2 ++
 .../gcp-filestore-persistence.md              |  3 ++-
 .../gcp-logging-persistence.md                |  3 ++-
 .../gcp-non-svc-persistence.md                |  3 ++-
 .../gcp-secret-manager-persistence.md         |  3 ++-
 .../gcp-storage-persistence.md                |  3 ++-
 .../gcp-post-exploitation/README.md           |  2 ++
 .../gcp-apigee-post-exploitation.md           |  2 ++
 .../gcp-app-engine-post-exploitation.md       |  3 ++-
 ...gcp-artifact-registry-post-exploitation.md |  3 ++-
 .../gcp-bigtable-post-exploitation.md         |  2 ++
 .../gcp-cloud-build-post-exploitation.md      |  3 ++-
 .../gcp-cloud-functions-post-exploitation.md  |  2 ++
 .../gcp-cloud-run-post-exploitation.md        |  2 ++
 .../gcp-cloud-shell-post-exploitation.md      |  2 ++
 .../gcp-cloud-sql-post-exploitation.md        |  2 ++
 .../gcp-compute-post-exploitation.md          |  3 ++-
 .../gcp-dataflow-post-exploitation.md         |  2 ++
 .../gcp-filestore-post-exploitation.md        |  3 ++-
 .../gcp-iam-post-exploitation.md              |  3 ++-
 .../gcp-kms-post-exploitation.md              |  2 ++
 .../gcp-logging-post-exploitation.md          |  2 ++
 .../gcp-monitoring-post-exploitation.md       |  3 ++-
 .../gcp-pub-sub-post-exploitation.md          |  2 ++
 .../gcp-secretmanager-post-exploitation.md    |  2 ++
 .../gcp-security-post-exploitation.md         |  2 ++
 .../gcp-storage-post-exploitation.md          |  2 ++
 .../gcp-vertex-ai-post-exploitation.md        |  2 ++
 .../gcp-workflows-post-exploitation.md        |  3 ++-
 .../gcp-privilege-escalation/README.md        |  2 ++
 .../gcp-apikeys-privesc.md                    |  2 ++
 .../gcp-appengine-privesc.md                  |  2 ++
 .../gcp-artifact-registry-privesc.md          |  3 ++-
 .../gcp-batch-privesc.md                      |  2 ++
 .../gcp-bigquery-privesc.md                   |  2 ++
 .../gcp-bigtable-privesc.md                   |  2 ++
 .../gcp-clientauthconfig-privesc.md           |  3 ++-
 .../gcp-cloud-workstations-privesc.md         |  2 ++
 .../gcp-cloudbuild-privesc.md                 |  2 ++
 .../gcp-cloudfunctions-privesc.md             |  2 ++
 .../gcp-cloudidentity-privesc.md              |  3 ++-
 .../gcp-cloudscheduler-privesc.md             |  2 ++
 .../gcp-cloudtasks-privesc.md                 |  2 ++
 .../gcp-composer-privesc.md                   |  2 ++
 .../gcp-compute-privesc/README.md             |  2 ++
 .../gcp-add-custom-ssh-metadata.md            |  3 ++-
 .../gcp-container-privesc.md                  |  3 ++-
 .../gcp-dataflow-privesc.md                   |  2 ++
 .../gcp-dataproc-privesc.md                   |  2 ++
 .../gcp-deploymentmaneger-privesc.md          |  3 ++-
 .../gcp-firebase-privesc.md                   |  2 ++
 .../gcp-iam-privesc.md                        |  2 ++
 .../gcp-kms-privesc.md                        |  2 ++
 ...local-privilege-escalation-ssh-pivoting.md |  2 ++
 .../gcp-misc-perms-privesc.md                 |  2 ++
 .../gcp-network-docker-escape.md              |  2 ++
 .../gcp-orgpolicy-privesc.md                  |  2 ++
 .../gcp-pubsub-privesc.md                     |  2 ++
 .../gcp-resourcemanager-privesc.md            |  3 ++-
 .../gcp-run-privesc.md                        |  3 ++-
 .../gcp-secretmanager-privesc.md              |  2 ++
 .../gcp-serviceusage-privesc.md               |  2 ++
 .../gcp-sourcerepos-privesc.md                |  2 ++
 .../gcp-storage-privesc.md                    |  3 ++-
 .../gcp-vertex-ai-privesc.md                  |  3 ++-
 .../gcp-workflows-privesc.md                  |  2 ++
 .../gcp-security/gcp-services/README.md       |  3 ++-
 .../gcp-services/gcp-ai-platform-enum.md      |  3 ++-
 .../gcp-services/gcp-api-keys-enum.md         |  3 ++-
 .../gcp-services/gcp-app-engine-enum.md       |  3 ++-
 .../gcp-artifact-registry-enum.md             |  3 ++-
 .../gcp-services/gcp-batch-enum.md            |  3 ++-
 .../gcp-services/gcp-bigquery-enum.md         |  3 ++-
 .../gcp-services/gcp-bigtable-enum.md         |  3 ++-
 .../gcp-services/gcp-cloud-build-enum.md      |  3 ++-
 .../gcp-services/gcp-cloud-functions-enum.md  |  3 ++-
 .../gcp-services/gcp-cloud-run-enum.md        |  3 ++-
 .../gcp-services/gcp-cloud-scheduler-enum.md  |  3 ++-
 .../gcp-services/gcp-cloud-shell-enum.md      |  3 ++-
 .../gcp-services/gcp-cloud-sql-enum.md        |  3 ++-
 .../gcp-services/gcp-composer-enum.md         |  3 ++-
 .../gcp-compute-instances-enum/README.md      |  3 ++-
 .../gcp-compute-instance.md                   |  3 ++-
 .../gcp-vpc-and-networking.md                 |  3 ++-
 .../gcp-containers-gke-and-composer-enum.md   |  3 ++-
 .../gcp-services/gcp-dataflow-enum.md         |  3 ++-
 .../gcp-services/gcp-dataproc-enum.md         |  3 ++-
 .../gcp-security/gcp-services/gcp-dns-enum.md |  3 ++-
 .../gcp-services/gcp-filestore-enum.md        |  3 ++-
 .../gcp-services/gcp-firebase-enum.md         |  3 ++-
 .../gcp-services/gcp-firestore-enum.md        |  3 ++-
 .../gcp-iam-and-org-policies-enum.md          |  3 ++-
 .../gcp-security/gcp-services/gcp-kms-enum.md |  3 ++-
 .../gcp-services/gcp-logging-enum.md          |  3 ++-
 .../gcp-services/gcp-memorystore-enum.md      |  3 ++-
 .../gcp-services/gcp-monitoring-enum.md       |  3 ++-
 .../gcp-security/gcp-services/gcp-pub-sub.md  |  3 ++-
 .../gcp-services/gcp-secrets-manager-enum.md  |  3 ++-
 .../gcp-services/gcp-security-enum.md         |  3 ++-
 .../gcp-source-repositories-enum.md           |  3 ++-
 .../gcp-services/gcp-spanner-enum.md          |  3 ++-
 .../gcp-services/gcp-stackdriver-enum.md      |  3 ++-
 .../gcp-services/gcp-storage-enum.md          |  3 ++-
 .../gcp-services/gcp-vertex-ai-enum.md        |  3 ++-
 .../gcp-services/gcp-workflows-enum.md        |  3 ++-
 .../gcp-to-workspace-pivoting/README.md       |  3 ++-
 ...cp-understanding-domain-wide-delegation.md |  3 ++-
 .../README.md                                 |  3 ++-
 .../gcp-api-keys-unauthenticated-enum.md      |  3 ++-
 .../gcp-app-engine-unauthenticated-enum.md    |  3 ++-
 ...-artifact-registry-unauthenticated-enum.md |  3 ++-
 .../gcp-cloud-build-unauthenticated-enum.md   |  3 ++-
 ...cp-cloud-functions-unauthenticated-enum.md |  3 ++-
 .../gcp-cloud-run-unauthenticated-enum.md     |  3 ++-
 .../gcp-cloud-sql-unauthenticated-enum.md     |  3 ++-
 .../gcp-compute-unauthenticated-enum.md       |  3 ++-
 ...principals-and-org-unauthenticated-enum.md |  3 ++-
 ...ource-repositories-unauthenticated-enum.md |  3 ++-
 .../README.md                                 |  3 ++-
 ...gcp-public-buckets-privilege-escalation.md |  3 ++-
 .../ibm-cloud-pentesting/README.md            |  2 ++
 .../ibm-basic-information.md                  |  3 ++-
 .../ibm-hyper-protect-crypto-services.md      |  2 ++
 .../ibm-hyper-protect-virtual-server.md       |  2 ++
 .../kubernetes-security/README.md             |  3 ++-
 .../README.md                                 |  3 ++-
 .../kubernetes-roles-abuse-lab.md             |  2 ++
 .../pod-escape-privileges.md                  |  3 ++-
 .../attacking-kubernetes-from-inside-a-pod.md |  2 ++
 .../exposing-services-in-kubernetes.md        |  3 ++-
 .../kubernetes-security/kubernetes-basics.md  |  2 ++
 .../kubernetes-enumeration.md                 |  3 ++-
 .../kubernetes-external-secrets-operator.md   |  2 ++
 .../kubernetes-hardening/README.md            |  3 ++-
 .../kubernetes-securitycontext-s.md           |  2 ++
 .../kubernetes-kyverno/README.md              |  2 ++
 .../kubernetes-kyverno-bypass.md              |  2 ++
 .../kubernetes-namespace-escalation.md        |  3 ++-
 .../kubernetes-network-attacks.md             |  2 ++
 .../kubernetes-opa-gatekeeper/README.md       |  2 ++
 .../kubernetes-opa-gatekeeper-bypass.md       |  2 ++
 .../kubernetes-pivoting-to-clouds.md          |  2 ++
 ...bernetes-role-based-access-control-rbac.md |  2 ++
 ...bernetes-validatingwebhookconfiguration.md |  2 ++
 .../pentesting-kubernetes-services/README.md  |  3 ++-
 ...ubelet-authentication-and-authorization.md |  2 ++
 .../openshift-pentesting/README.md            |  2 ++
 .../openshift-basic-information.md            |  2 ++
 .../openshift-jenkins/README.md               |  2 ++
 .../openshift-jenkins-build-overrides.md      |  2 ++
 .../openshift-privilege-escalation/README.md  |  2 ++
 .../openshift-missing-service-account.md      |  2 ++
 .../openshift-scc-bypass.md                   |  2 ++
 .../openshift-tekton.md                       |  2 ++
 .../openshift-pentesting/openshift-scc.md     |  2 ++
 .../pentesting-cloud-methodology.md           |  2 ++
 .../workspace-security/README.md              |  3 ++-
 .../gws-google-platforms-phishing/README.md   |  3 ++-
 .../gws-app-scripts.md                        |  3 ++-
 .../workspace-security/gws-persistence.md     |  3 ++-
 .../gws-post-exploitation.md                  |  3 ++-
 .../README.md                                 |  3 ++-
 .../gcds-google-cloud-directory-sync.md       |  3 ++-
 ...-google-credential-provider-for-windows.md |  3 ++-
 .../gps-google-password-sync.md               |  3 ++-
 .../gws-admin-directory-sync.md               |  3 ++-
 590 files changed, 1204 insertions(+), 234 deletions(-)

diff --git a/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md b/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md
index 2539aaee76..c598543019 100644
--- a/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md
+++ b/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md
@@ -1,5 +1,7 @@
 # Ansible Tower / AWX / Automation controller Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Ansible Tower** or it's opensource version [**AWX**](https://github.com/ansible/awx) is also known as **Ansible’s user interface, dashboard, and REST API**.<sup>[[3]](#references)</sup> With **role-based access control**, job scheduling, and graphical inventory management, you can manage your Ansible infrastructure from a modern UI. Tower’s REST API and command-line interface make it simple to integrate it into current tools and workflows.
diff --git a/src/pentesting-ci-cd/apache-airflow-security/README.md b/src/pentesting-ci-cd/apache-airflow-security/README.md
index 57aa270ca4..6193d506ae 100644
--- a/src/pentesting-ci-cd/apache-airflow-security/README.md
+++ b/src/pentesting-ci-cd/apache-airflow-security/README.md
@@ -1,5 +1,7 @@
 # Apache Airflow Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ### Basic Information
 
 [**Apache Airflow**](https://airflow.apache.org) serves as a platform for **orchestrating and scheduling data pipelines or workflows**. The term "orchestration" in the context of data pipelines signifies the process of arranging, coordinating, and managing complex data workflows originating from various sources. The primary purpose of these orchestrated data pipelines is to furnish processed and consumable data sets. These data sets are extensively utilized by a myriad of applications, including but not limited to business intelligence tools, data science and machine learning models, all of which are foundational to the functioning of big data applications.<sup>[[1]](#references)</sup>
@@ -198,4 +200,3 @@ If they are used for example inside a a bash command, you could perform a comman
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md b/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md
index 025ee2deb3..9f328300e2 100644
--- a/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md
+++ b/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md
@@ -1,5 +1,7 @@
 # Airflow Configuration
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Configuration File
 
 **Apache Airflow** generates a **config file** in all the airflow machines called **`airflow.cfg`** in the home of the airflow user. This config file contains configuration information and **might contain interesting and sensitive information.**<sup>[[10]](#references)</sup>
diff --git a/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md b/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md
index bc148d5473..85670e0d71 100644
--- a/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md
+++ b/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md
@@ -1,5 +1,7 @@
 # Airflow RBAC
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## RBAC
 
 Airflow ships with five default roles: **Admin**, **User**, **Op**, **Viewer**, and **Public**. Only **`Admin`** users can configure or alter role permissions, and the defaults should remain unchanged; create a custom role when a more granular permission set is needed.<sup>[[1]](#references)</sup>
@@ -47,4 +49,3 @@ No permissions.<sup>[[3]](#references)</sup>
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-ci-cd/argocd-security.md b/src/pentesting-ci-cd/argocd-security.md
index 2cd550a536..f1203809fd 100644
--- a/src/pentesting-ci-cd/argocd-security.md
+++ b/src/pentesting-ci-cd/argocd-security.md
@@ -1,5 +1,7 @@
 # Argo CD Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 [Argo CD](https://argo-cd.readthedocs.io/) is a GitOps continuous delivery platform for Kubernetes. It watches Git repositories, renders Kubernetes manifests with tools such as Helm, Kustomize, Jsonnet or config management plugins, and reconciles the live cluster state with the desired state stored in Git.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-ci-cd/atlantis-security.md b/src/pentesting-ci-cd/atlantis-security.md
index d8f114c4a6..49dc1c2cdc 100644
--- a/src/pentesting-ci-cd/atlantis-security.md
+++ b/src/pentesting-ci-cd/atlantis-security.md
@@ -1,5 +1,7 @@
 # Atlantis Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ### Basic Information
 
 Atlantis is a pull-request-driven service that runs Terraform commands from comments on a Git host.<sup>[[1]](#references)[[13]](#references)</sup>
@@ -391,4 +393,3 @@ You can also pass these as environment variables `ATLANTIS_WEB_BASIC_AUTH=true`
 - [29] [Managing protected branches | GitHub Docs](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches)
 
 {{#include ../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/chef-automate-security/README.md b/src/pentesting-ci-cd/chef-automate-security/README.md
index 96bb440d56..fb89813079 100644
--- a/src/pentesting-ci-cd/chef-automate-security/README.md
+++ b/src/pentesting-ci-cd/chef-automate-security/README.md
@@ -1,5 +1,7 @@
 # Chef Automate Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is Chef Automate
 
 Chef Automate is a platform for infrastructure automation, compliance, and application delivery.<sup>[[1]](#references)</sup> It exposes a web UI (often Angular) that talks to backend gRPC services via a gRPC-Gateway, providing REST-like endpoints under paths such as /api/v0/.<sup>[[3]](#references)</sup>
diff --git a/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md b/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md
index 39ffc7bae0..87f5d38bb6 100644
--- a/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md
+++ b/src/pentesting-ci-cd/chef-automate-security/chef-automate-enumeration-and-attacks.md
@@ -1,5 +1,7 @@
 # Chef Automate Enumeration & Attacks
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Overview
 
 This page collects practical techniques to enumerate and attack Chef Automate instances, with emphasis on:
diff --git a/src/pentesting-ci-cd/circleci-security.md b/src/pentesting-ci-cd/circleci-security.md
index 78cf034616..3eb3a595e4 100644
--- a/src/pentesting-ci-cd/circleci-security.md
+++ b/src/pentesting-ci-cd/circleci-security.md
@@ -1,5 +1,7 @@
 # CircleCI Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ### Basic Information
 
 [**CircleCI**](https://circleci.com/docs/2.0/about-circleci/) is a Continuos Integration platform where you can **define templates** indicating what you want it to do with some code and when to do it. This way you can **automate testing** or **deployments** directly **from your repo master branch** for example.<sup>[[1]](#references)</sup>
@@ -85,6 +87,27 @@ These are secrets that are **org wide**. By **default**, a new context uses the
 
 ### Attacks
 
+#### CircleCI MCP server: `Host`/`Origin` bypass to pipeline RCE
+
+CircleCI's remote MCP transport can be deployed in **shared-token mode**: the server keeps the organization's `CIRCLECI_TOKEN`, while `REQUIRE_REQUEST_TOKEN=false` lets callers access `/mcp` without presenting their own credential. In versions `0.16.1` through `0.19.1`, combining this mode with the default `MCP_BIND_HOST=0.0.0.0` exposed that delegated token to any peer able to route to the listening port.<sup>[[11]](#references)[[12]](#references)</sup>
+
+The vulnerable gate treated an allowlisted `Host` plus an absent `Origin` as sufficient. This only mitigates browser-based DNS rebinding: a direct HTTP client controls `Host` and can simply omit `Origin`. Moreover, `Host: localhost` identifies the requested virtual host, **not** the interface through which the TCP connection arrived, so it does not prove that a wildcard-bound request came from loopback.<sup>[[11]](#references)[[12]](#references)</sup>
+
+During an authorized assessment, compare a rejected host with the expected loopback spelling (include the listening port if the allowlist does). `curl` sends no `Origin` by default; `-H 'Origin:'` also ensures that the header is omitted. A change from the guard's `403` to an MCP/HTTP transport response shows that the client-controlled headers passed the gate—it does not by itself prove tool authorization.<sup>[[11]](#references)[[12]](#references)</sup>
+
+```bash
+target='http://10.0.0.10:8000'
+
+curl -i "$target/mcp" -H 'Host: rejected.invalid'
+curl -i "$target/mcp" -H 'Host: localhost:8000' -H 'Origin:'
+```
+
+Once unauthorized MCP access is obtained, `run_pipeline` supplies the execution primitive: it accepts attacker-controlled CircleCI pipeline YAML, so a configuration containing a shell-capable `run:` step executes inside CI using the server's delegated token. No separate command-injection bug is required; the resulting job may inherit project variables, contexts, cloud/OIDC identity, signing keys, or registry credentials according to its CircleCI permissions. The [environment-exfiltration pipeline below](#exfiltrate-project-secrets) illustrates the downstream primitive.<sup>[[11]](#references)[[12]](#references)</sup>
+
+For detection, flag `Host: localhost`/loopback hostnames received from non-loopback peers, missing `Origin` on externally reachable MCP requests, and unexpected `run_pipeline` calls. Correlate MCP request/tool identifiers with CircleCI pipeline and job IDs, the submitted configuration, context use, and cloud or secret-manager audit events; endpoint-only logs miss the consequential activity in the delegated CI job.<sup>[[11]](#references)[[12]](#references)</sup>
+
+Upgrade to `0.19.2` or later. On older releases, set `REQUIRE_REQUEST_TOKEN=true`; if shared-token mode is unavoidable, bind to loopback with `MCP_BIND_HOST=127.0.0.1` and restrict reachability. The patch refuses to start unauthenticated remote transport on a non-loopback bind unless `MCP_ALLOW_UNAUTHENTICATED_NETWORK_ACCESS=true` explicitly acknowledges the risk. It deliberately still allows absent `Origin` and retains the wildcard default because these headers remain a DNS-rebinding defense, while caller authentication is the actual security boundary.<sup>[[12]](#references)</sup>
+
 #### Search Clear Text Secrets
 
 If you have **access to the VCS** (like github) check the file `.circleci/config.yml` of **each repo on each branch** and **search** for potential **clear text secrets** stored in there.
@@ -262,6 +285,7 @@ jobs:
 - [8] [Secure secrets handling](https://circleci.com/docs/guides/security/security-recommendations/)
 - [9] [CircleCI’s self-hosted runner overview](https://circleci.com/docs/guides/execution-runner/runner-overview/)
 - [10] [Configuration reference](https://circleci.com/docs/reference/configuration-reference/)
+- [11] [Critical Unauthenticated Remote Code Execution in CircleCI's MCP Server](https://remedio.io/blog/the-critical-unauthenticated-rce-vulnerability-in-circlecis-mcp-server)
+- [12] [GHSA-xv5j-cwgj-22r4: Remote transport Host/Origin authentication bypass](https://github.com/CircleCI-Public/mcp-server-circleci/security/advisories/GHSA-xv5j-cwgj-22r4)
 
 {{#include ../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/cloudflare-security/README.md b/src/pentesting-ci-cd/cloudflare-security/README.md
index 0a07bc8903..f0f128fac1 100644
--- a/src/pentesting-ci-cd/cloudflare-security/README.md
+++ b/src/pentesting-ci-cd/cloudflare-security/README.md
@@ -1,5 +1,7 @@
 # Cloudflare Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 In a Cloudflare account there are some **general settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:**
 
 <figure><img src="../../images/image (117).png" alt=""><figcaption></figcaption></figure>
diff --git a/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md b/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md
index a5df3126f4..a360378167 100644
--- a/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md
+++ b/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md
@@ -1,5 +1,7 @@
 # Cloudflare Domains
 
+{{#include ../../banners/hacktricks-training.md}}
+
 In each zone configured in Cloudflare there are **general settings and services** that can be configured. In this page we are going to **analyze the security-related settings of each section:**
 
 <figure><img src="../../images/image (101).png" alt=""><figcaption></figcaption></figure>
@@ -171,4 +173,3 @@ TODO
 - [37] [API deprecations](https://developers.cloudflare.com/fundamentals/api/reference/deprecations/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/cloudflare-security/cloudflare-workers-pass-through-proxy-ip-rotation.md b/src/pentesting-ci-cd/cloudflare-security/cloudflare-workers-pass-through-proxy-ip-rotation.md
index 7902742621..075f375fb3 100644
--- a/src/pentesting-ci-cd/cloudflare-security/cloudflare-workers-pass-through-proxy-ip-rotation.md
+++ b/src/pentesting-ci-cd/cloudflare-security/cloudflare-workers-pass-through-proxy-ip-rotation.md
@@ -1,5 +1,7 @@
 # Abusing Cloudflare Workers as pass-through proxies (IP rotation, FireProx-style)
 
+{{#include ../../banners/hacktricks-training.md}}
+
 Cloudflare Workers can be deployed as transparent HTTP pass-through proxies where the upstream target URL is supplied by the client. Requests egress from Cloudflare's network so the target observes Cloudflare IPs instead of the client's. This mirrors the well-known FireProx technique on AWS API Gateway, but uses Cloudflare Workers.<sup>[[1]](#references)[[4]](#references)</sup>
 
 ### Key capabilities
diff --git a/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md b/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md
index 6aa76381af..9531b34361 100644
--- a/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md
+++ b/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md
@@ -1,5 +1,7 @@
 # Cloudflare Zero Trust Network
 
+{{#include ../../banners/hacktricks-training.md}}
+
 In a **Cloudflare Zero Trust Network** account there are some **settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:**
 
 <figure><img src="../../images/image (206).png" alt=""><figcaption></figcaption></figure>
diff --git a/src/pentesting-ci-cd/concourse-security/README.md b/src/pentesting-ci-cd/concourse-security/README.md
index 852e85006e..b7b9263200 100644
--- a/src/pentesting-ci-cd/concourse-security/README.md
+++ b/src/pentesting-ci-cd/concourse-security/README.md
@@ -1,5 +1,7 @@
 # Concourse Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Concourse allows you to **build pipelines** to automatically run tests, actions and build images whenever you need it (time based, when something happens...)<sup>[[1]](#references)[[2]](#references)</sup>
@@ -35,4 +37,3 @@ concourse-enumeration-and-attacks.md
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-ci-cd/concourse-security/concourse-architecture.md b/src/pentesting-ci-cd/concourse-security/concourse-architecture.md
index 96d0a7126f..603fcc015f 100644
--- a/src/pentesting-ci-cd/concourse-security/concourse-architecture.md
+++ b/src/pentesting-ci-cd/concourse-security/concourse-architecture.md
@@ -1,5 +1,7 @@
 # Concourse Architecture
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Concourse Architecture
 
 
@@ -42,4 +44,3 @@ In order to execute tasks, Concourse must have some workers. These workers **reg
 - [7] [Baggageclaim](https://github.com/concourse/baggageclaim)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md b/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md
index bbe0707741..f34b293159 100644
--- a/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md
+++ b/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md
@@ -1,5 +1,7 @@
 # Concourse Enumeration & Attacks
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Concourse Enumeration & Attacks
 
 
diff --git a/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md b/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md
index f9eb0b07d3..dd6403a570 100644
--- a/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md
+++ b/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md
@@ -1,5 +1,7 @@
 # Concourse Lab Creation
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Testing Environment
 
 ### Running Concourse
@@ -172,4 +174,3 @@ Check a YAML pipeline example that triggers on new commits to master in [https:/
 - [15] [Across Step Modifier - Concourse](https://concourse-ci.org/docs/steps/modifier-and-hooks/across/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/docker-build-context-abuse.md b/src/pentesting-ci-cd/docker-build-context-abuse.md
index fb5c442ff9..af53661a13 100644
--- a/src/pentesting-ci-cd/docker-build-context-abuse.md
+++ b/src/pentesting-ci-cd/docker-build-context-abuse.md
@@ -1,5 +1,7 @@
 # Abusing Docker Build Context in Hosted Builders (Path Traversal, Exfil, and Cloud Pivot)
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## TL;DR
 
 If a CI/CD platform or hosted builder lets contributors specify the Docker build context path and Dockerfile path, you can often set the context to a parent directory (e.g., "..") and make host files part of the build context. Then, an attacker-controlled Dockerfile can COPY and exfiltrate secrets found in the builder user’s home (for example, ~/.docker/config.json). Stolen registry tokens may also work against the provider’s control-plane APIs, enabling org-wide RCE.<sup>[[1]](#references)[[3]](#references)[[4]](#references)[[5]](#references)[[6]](#references)</sup>
diff --git a/src/pentesting-ci-cd/gitblit-security/README.md b/src/pentesting-ci-cd/gitblit-security/README.md
index 2528bde805..180d9a163f 100644
--- a/src/pentesting-ci-cd/gitblit-security/README.md
+++ b/src/pentesting-ci-cd/gitblit-security/README.md
@@ -1,5 +1,7 @@
 # Gitblit Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is Gitblit
 
 Gitblit is a self‑hosted Git server written in Java.<sup>[[1]](#references)</sup> It can run as a standalone JAR or in servlet containers and ships an embedded SSH service (Apache MINA SSHD) for Git over SSH.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-ci-cd/gitblit-security/gitblit-embedded-ssh-auth-bypass-cve-2024-28080.md b/src/pentesting-ci-cd/gitblit-security/gitblit-embedded-ssh-auth-bypass-cve-2024-28080.md
index 56ec1cca3d..482754e3fc 100644
--- a/src/pentesting-ci-cd/gitblit-security/gitblit-embedded-ssh-auth-bypass-cve-2024-28080.md
+++ b/src/pentesting-ci-cd/gitblit-security/gitblit-embedded-ssh-auth-bypass-cve-2024-28080.md
@@ -1,5 +1,7 @@
 # Gitblit Embedded SSH Auth Bypass (CVE-2024-28080)
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Summary
 
 CVE-2024-28080 is an authentication bypass in Gitblit's embedded SSH transport caused by session state being treated as authenticated before a public-key signature is verified. In the vulnerable v1.9.3 implementation, a matching public key populated the SSH client state and the password authenticator accepted any subsequent password without validating it, so an attacker who knows a Gitblit username and one of that account's registered public keys can authenticate without the private key or a valid password.<sup>[[1]](#references)[[5]](#references)[[6]](#references)[[7]](#references)[[9]](#references)</sup>
@@ -130,4 +132,3 @@ Related protocol/design notes and literature:
 - [15] [OpenSSH client public-key authentication source](https://github.com/openssh/openssh-portable/blob/master/sshconnect2.c)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/gitea-security/README.md b/src/pentesting-ci-cd/gitea-security/README.md
index 6f08567714..5c74bfdd5b 100644
--- a/src/pentesting-ci-cd/gitea-security/README.md
+++ b/src/pentesting-ci-cd/gitea-security/README.md
@@ -1,5 +1,7 @@
 # Gitea Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is Gitea
 
 **Gitea** is a **self-hosted community managed lightweight code hosting** solution written in Go.<sup>[[1]](#references)</sup>
@@ -158,4 +160,3 @@ If you are inside the server you can also **use the `gitea` binary** to access/m
 - [21] [Gitea Command Line | Gitea Documentation](https://docs.gitea.com/1.26/administration/command-line)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md b/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md
index 37d93fa2e7..b7fffb0dcb 100644
--- a/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md
+++ b/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md
@@ -1,5 +1,7 @@
 # Basic Gitea Information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Structure
 
 The basic Gitea environment structure is to group repos by **organization(s),** each of them may contain **several repositories** and **several teams.** However, note that just like in github users can have repos outside of the organization.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-ci-cd/github-security/README.md b/src/pentesting-ci-cd/github-security/README.md
index 2865cf6c3a..7afe30e2ec 100644
--- a/src/pentesting-ci-cd/github-security/README.md
+++ b/src/pentesting-ci-cd/github-security/README.md
@@ -1,5 +1,7 @@
 # Github Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is Github
 
 (From [here](https://kinsta.com/knowledgebase/what-is-github/)) At a high level, **GitHub is a website and cloud-based service that helps developers store and manage their code, as well as track and control changes to their code**.<sup>[[8]](#references)</sup>
@@ -485,4 +487,3 @@ For more information, see [Chainguard’s imposter-commits research](https://www
 - [54] [GitHub public SSH keys (example: octocat)](https://github.com/octocat.keys)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md
index f3a9899db3..c312322036 100644
--- a/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md
+++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md
@@ -1,5 +1,7 @@
 # Abusing Github Actions
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Tools
 
 The following tools are useful to find Github Action workflows and even find vulnerable ones:
@@ -954,4 +956,3 @@ An organization in GitHub is very proactive in reporting accounts to GitHub. All
 - [45] [Vulnerable GitHub Actions Workflows: CI/CD Pipeline Attacks](https://www.legitsecurity.com/blog/github-actions-that-open-the-door-to-cicd-pipeline-attacks)
 - [46] [actions/toolkit core package - GitHub](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret)
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md
index 22250e8749..a3039f844f 100644
--- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md
+++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md
@@ -1,6 +1,7 @@
 # Gh Actions - Artifact Poisoning
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md
index 6dc2ee393f..89e82b6ee5 100644
--- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md
+++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md
@@ -1,5 +1,7 @@
 # GH Actions - Cache Poisoning
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Overview
 
 The GitHub Actions cache is shared across workflow runs in a repository, subject to branch and tag scope, rather than isolated per workflow or job. Historically, any workflow run with cache-write access that knew a cache `key` (or `restore-keys`) could populate that entry even if the job only had `permissions: contents: read`, so an attacker who compromised a low-privilege job could poison a cache that a privileged release job later restored.<sup>[[1]](#references)[[2]](#references)[[6]](#references)</sup> This is how the Ultralytics compromise pivoted from a `pull_request_target` workflow into the PyPI publishing pipeline.<sup>[[1]](#references)[[5]](#references)</sup>
diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md
index eee5e23125..b39dba83c4 100644
--- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md
+++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md
@@ -1,5 +1,7 @@
 # Gh Actions - Context Script Injections
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Understanding the risk
 
 GitHub Actions renders expressions ${{ ... }} before the step executes. The rendered value is pasted into the step’s program (for run steps, a shell script). If you interpolate untrusted input directly inside run:, the attacker controls part of the shell program and can execute arbitrary commands.<sup>[[5]](#references)[[7]](#references)[[8]](#references)</sup>
diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md
index 2372cba073..cfbc2d5ab3 100644
--- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md
+++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md
@@ -1,5 +1,7 @@
 # GH Actions - npm Supply Chain Abuse
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Overview
 
 After an attacker gets code execution in a GitHub Actions release workflow, maintainer workstation, or package build pipeline, npm publishing becomes a high-impact pivot. The goal is usually to steal publisher identity material, publish malicious versions, and turn downstream installs into more credential-generation nodes.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md b/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md
index 7aa1b37894..7cecd3f796 100644
--- a/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md
+++ b/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md
@@ -1,5 +1,7 @@
 # Accessible Deleted Data in GitHub
 
+{{#include ../../banners/hacktricks-training.md}}
+
 These ways to access data from GitHub that was supposedly deleted were [**reported in this blog post**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github).<sup>[[1]](#references)</sup>
 
 ## Accessing Deleted Fork Data
@@ -54,4 +56,3 @@ The latter uses a short SHA-1 value that can be brute-forced.<sup>[[1]](#referen
 - [3] [Git revisions documentation](https://git-scm.com/docs/revisions)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/github-security/basic-github-information.md b/src/pentesting-ci-cd/github-security/basic-github-information.md
index 2b54978ff7..0302bf345b 100644
--- a/src/pentesting-ci-cd/github-security/basic-github-information.md
+++ b/src/pentesting-ci-cd/github-security/basic-github-information.md
@@ -1,5 +1,7 @@
 # Basic Github Information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Structure
 
 The basic github environment structure of a big **company** is to own an **enterprise** which owns **several organizations** and each of them may contain **several repositories** and **several teams.**. Smaller companies may just **own one organization and no enterprises**.<sup>[[4]](#references)[[13]](#references)</sup>
@@ -300,4 +302,3 @@ This chain prevents a single collaborator from retagging or force-publishing rel
 - [39] [About rulesets](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/gogs-security/README.md b/src/pentesting-ci-cd/gogs-security/README.md
index 1f05656ce5..0413b1e055 100644
--- a/src/pentesting-ci-cd/gogs-security/README.md
+++ b/src/pentesting-ci-cd/gogs-security/README.md
@@ -1,5 +1,7 @@
 # Gogs Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is Gogs
 
 **Gogs** is a **self-hosted lightweight Git service** written in Go. From an attacker point of view, treat it as a **multi-tenant Git hosting platform** where a low-privileged user may still control branch names, pull requests, webhooks, tokens, and repository settings.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-ci-cd/jenkins-security/README.md b/src/pentesting-ci-cd/jenkins-security/README.md
index 127f689e93..17fd0d69b1 100644
--- a/src/pentesting-ci-cd/jenkins-security/README.md
+++ b/src/pentesting-ci-cd/jenkins-security/README.md
@@ -1,5 +1,7 @@
 # Jenkins Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Jenkins is a tool that offers a straightforward method for establishing a **continuous integration** or **continuous delivery** (CI/CD) environment for almost **any** combination of **programming languages** and source code repositories using pipelines. Furthermore, it automates various routine development tasks. While Jenkins doesn't eliminate the **need to create scripts for individual steps**, it does provide a faster and more robust way to integrate the entire sequence of build, test, and deployment tools than one can easily construct manually.
@@ -442,4 +444,3 @@ println(hudson.util.Secret.decrypt("{...}"))
 - [20] [Using credentials](https://www.jenkins.io/doc/book/using/using-credentials/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md b/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md
index 5781525796..9e97d7cecd 100644
--- a/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md
+++ b/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md
@@ -1,5 +1,7 @@
 # Basic Jenkins Information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Access
 
 ### Username + Password
diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md b/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md
index 4f85a882a6..dff1f24568 100644
--- a/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md
+++ b/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md
@@ -1,5 +1,7 @@
 # Jenkins Arbitrary File Read to RCE via "Remember Me"
 
+{{#include ../../banners/hacktricks-training.md}}
+
 The original page linked the [SecureLayer7 Spring Cloud Skipper post](https://blog.securelayer7.net/spring-cloud-skipper-vulnerability/), but that article covers a different vulnerability; the Jenkins chain summarized here is documented in Conviso's analysis of CVE-2024-43044 and its companion PoC, which use an arbitrary file read to forge an administrator remember-me cookie and reach the Script Console.<sup>[[5]](#references)[[6]](#references)[[7]](#references)</sup>
 
 The following is a concise summary of the cookie-forging portion of that exploit chain.<sup>[[6]](#references)</sup>
@@ -109,4 +111,3 @@ The example curl command demonstrates the request structure; use this technique
 - [7] [CVE-2024-37084: Spring Cloud Remote Code Execution](https://blog.securelayer7.net/spring-cloud-skipper-vulnerability/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md b/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md
index 4dbc1490c6..12296d9cae 100644
--- a/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md
+++ b/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md
@@ -1,5 +1,7 @@
 # Jenkins Dumping Secrets from Groovy
 
+{{#include ../../banners/hacktricks-training.md}}
+
 > [!WARNING]
 > Note that these scripts will only list the secrets inside the `credentials.xml` file, but **build configuration files** might also have **more credentials**.<sup>[[2]](#references)[[3]](#references)</sup>
 
@@ -99,4 +101,3 @@ for (c in creds) {
 - [7] [How do I list all of my Jenkins credentials in the script console?](https://stackoverflow.com/questions/34795050/how-do-i-list-all-of-my-jenkins-credentials-in-the-script-console)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md
index b54867f6b7..294b7963eb 100644
--- a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md
+++ b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md
@@ -1,5 +1,7 @@
 # Jenkins RCE Creating/Modifying Pipeline
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Creating a new Pipeline
 
 In "New Item" (accessible in `/view/all/newJob`) select **Pipeline:**<sup>[[1]](#references)</sup>
@@ -44,4 +46,3 @@ Jenkins stores scripts entered through the classic UI in its Jenkins home direct
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md
index 00bdd29c18..ef76a5deba 100644
--- a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md
+++ b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md
@@ -1,5 +1,7 @@
 # Jenkins RCE Creating/Modifying Project
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Creating a Project
 
 This method is very noisy because you have to create a hole new project (obviously this will only work if you user is allowed to create a new project).<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md
index 86d74bf4c3..542cef9d22 100644
--- a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md
+++ b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md
@@ -1,5 +1,7 @@
 # Jenkins RCE with Groovy Script
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Jenkins RCE with Groovy Script
 
 The Jenkins Script Console is a web-based Groovy shell controlled by the `Administer` permission and can create subprocesses on the controller or agents.<sup>[[1]](#references)</sup>
@@ -82,4 +84,3 @@ msf> use exploit/multi/http/jenkins/script_console
 - [8] [Invoke-Expression (Microsoft.PowerShell.Utility)](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.6)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/okta-security/README.md b/src/pentesting-ci-cd/okta-security/README.md
index 0fe371eff0..e425f46fa1 100644
--- a/src/pentesting-ci-cd/okta-security/README.md
+++ b/src/pentesting-ci-cd/okta-security/README.md
@@ -1,5 +1,7 @@
 # Okta Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 [Okta, Inc.](https://www.okta.com/) is an identity and access management provider whose cloud services are used to centralize authentication and access to applications, services, and devices.<sup>[[3]](#references)</sup>
diff --git a/src/pentesting-ci-cd/okta-security/okta-hardening.md b/src/pentesting-ci-cd/okta-security/okta-hardening.md
index ac08cc61f6..76b3a3255d 100644
--- a/src/pentesting-ci-cd/okta-security/okta-hardening.md
+++ b/src/pentesting-ci-cd/okta-security/okta-hardening.md
@@ -1,5 +1,7 @@
 # Okta Hardening
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Directory
 
 ### People
@@ -234,4 +236,3 @@ Here you can download Okta agents to sync Okta with other technologies.<sup>[[35
 - [36] [Allow users to edit attributes](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-user-edit-attributes.htm)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md b/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md
index e68944f996..babe643b31 100644
--- a/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md
+++ b/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md
@@ -1,5 +1,7 @@
 # Pentesting CI/CD Methodology
 
+{{#include ../banners/hacktricks-training.md}}
+
 <figure><img src="../images/CLOUD-logo-letters.svg" alt=""><figcaption></figcaption></figure>
 
 ## VCS
diff --git a/src/pentesting-ci-cd/serverless.com-security.md b/src/pentesting-ci-cd/serverless.com-security.md
index 124ed6101b..e5a537ea1c 100644
--- a/src/pentesting-ci-cd/serverless.com-security.md
+++ b/src/pentesting-ci-cd/serverless.com-security.md
@@ -1,5 +1,7 @@
 # Serverless.com Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 ### Organization
@@ -867,4 +869,3 @@ Granting excessive permissions to team members and external collaborators can le
 - [25] [GetFunctionConfiguration - AWS Lambda](https://docs.aws.amazon.com/lambda/latest/api/API_GetFunctionConfiguration.html)
 
 {{#include ../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/supabase-security.md b/src/pentesting-ci-cd/supabase-security.md
index 10dd6c126e..abf2e8b017 100644
--- a/src/pentesting-ci-cd/supabase-security.md
+++ b/src/pentesting-ci-cd/supabase-security.md
@@ -1,5 +1,7 @@
 # Supabase Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 As per their [**landing page**](https://supabase.com/): Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, Storage, and Vector embeddings.<sup>[[8]](#references)</sup>
@@ -296,4 +298,3 @@ It's possible to **store secrets** in supabase also which will be **accessible b
 - [26] [Supabase: Configure Phone Login & MFA](https://supabase.com/docs/guides/self-hosting/self-hosted-phone-mfa)
 
 {{#include ../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/teamcity-security/README.md b/src/pentesting-ci-cd/teamcity-security/README.md
index 2a780988ad..de4a517ab3 100644
--- a/src/pentesting-ci-cd/teamcity-security/README.md
+++ b/src/pentesting-ci-cd/teamcity-security/README.md
@@ -1,5 +1,7 @@
 # TeamCity Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 [TeamCity](https://www.jetbrains.com/teamcity/) is JetBrains' CI/CD server. It can run as **TeamCity Cloud** or as **TeamCity On-Premises**. In real environments the on-premises product is the most interesting target because it is commonly connected to private repositories, deployment credentials, internal networks, and cloud build agents.<sup>[[16]](#references)</sup>
diff --git a/src/pentesting-ci-cd/terraform-security.md b/src/pentesting-ci-cd/terraform-security.md
index ba5a01684d..2bed795f31 100644
--- a/src/pentesting-ci-cd/terraform-security.md
+++ b/src/pentesting-ci-cd/terraform-security.md
@@ -1,5 +1,7 @@
 # Terraform Security
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 [From the docs:](https://developer.hashicorp.com/terraform/intro)
@@ -473,4 +475,3 @@ docker run -t -v $(pwd):/path checkmarx/kics:latest scan -p /path -o "/path/"
 - [38] [KICS](https://github.com/Checkmarx/kics)
 
 {{#include ../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/todo.md b/src/pentesting-ci-cd/todo.md
index 083936a1f8..cd1fa81420 100644
--- a/src/pentesting-ci-cd/todo.md
+++ b/src/pentesting-ci-cd/todo.md
@@ -1,5 +1,7 @@
 # TODO
 
+{{#include ../banners/hacktricks-training.md}}
+
 Github PRs are welcome explaining how to (ab)use those platforms from an attacker perspective
 
 - Drone
@@ -15,4 +17,3 @@ Github PRs are welcome explaining how to (ab)use those platforms from an attacke
 
 {{#include ../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-ci-cd/travisci-security/README.md b/src/pentesting-ci-cd/travisci-security/README.md
index 04ab8116ed..123cc6f5c8 100644
--- a/src/pentesting-ci-cd/travisci-security/README.md
+++ b/src/pentesting-ci-cd/travisci-security/README.md
@@ -1,5 +1,7 @@
 # TravisCI Security
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is TravisCI
 
 **Travis CI** is a **hosted** or on **premises** **continuous integration** service used to build and test software projects hosted on several **different git platform**.
@@ -67,4 +69,3 @@ If an attacker ends in an environment which uses **TravisCI enterprise** (more i
 - [8] [Setup Travis CI Enterprise Worker Machine](https://docs.travis-ci.com/user/enterprise/setting-up-worker/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md b/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md
index 27e1d3d7d5..3cb1658120 100644
--- a/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md
+++ b/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md
@@ -1,5 +1,7 @@
 # Basic TravisCI Information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Access
 
 TravisCI directly integrates with different git platforms such as Github, Bitbucket, Assembla, and Gitlab. It will ask the user to give TravisCI permissions to access the repos he wants to integrate with TravisCI.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-ci-cd/vercel-security.md b/src/pentesting-ci-cd/vercel-security.md
index e6cb2c59f2..3b88d9347c 100644
--- a/src/pentesting-ci-cd/vercel-security.md
+++ b/src/pentesting-ci-cd/vercel-security.md
@@ -1,5 +1,7 @@
 # Vercel
 
+{{#include ../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 In Vercel a **Team** is the complete **environment** that belongs a client and a **project** is an **application**.<sup>[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/README.md b/src/pentesting-cloud/aws-security/README.md
index d1db1077b8..de7fbe63aa 100644
--- a/src/pentesting-cloud/aws-security/README.md
+++ b/src/pentesting-cloud/aws-security/README.md
@@ -1,5 +1,7 @@
 # AWS Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Before starting an **AWS** pentest, understand how AWS accounts, Organizations, IAM, service exposure, and trust relationships fit together.
@@ -442,4 +444,3 @@ aws ...
 - [49] [StreamAlert repository](https://github.com/airbnb/streamalert)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-basic-information/README.md b/src/pentesting-cloud/aws-security/aws-basic-information/README.md
index e68a4a3b7a..27574eacf5 100644
--- a/src/pentesting-cloud/aws-security/aws-basic-information/README.md
+++ b/src/pentesting-cloud/aws-security/aws-basic-information/README.md
@@ -1,5 +1,7 @@
 # AWS - Basic Information
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Organization Hierarchy
 
 ![AWS Organizations hierarchy diagram with organization root, organizational units, member accounts, policies, and users](<../../../images/image (151).png>)
@@ -450,4 +452,3 @@ The command _must_ return credentials to STDOUT in the following format. When `E
 - [35] [Getting started with Simple AD](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/simple_ad_getting_started.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md b/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md
index e05a0fa9cf..74254e0b6f 100644
--- a/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md
+++ b/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md
@@ -1,5 +1,7 @@
 # AWS - Federation Abuse
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## SAML
 
 For background on SAML attacks, see [SAML attacks](https://book.hacktricks.wiki/en/pentesting-web/saml-attacks/index.html).<sup>[[3]](#references)</sup>
@@ -141,4 +143,3 @@ An explicit `sub` condition prevents other service accounts in the cluster or na
 - [12] [Get started with Amazon EKS - eksctl](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md b/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md
index 80dad75abb..f65609c918 100644
--- a/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md
+++ b/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md
@@ -1,5 +1,7 @@
 # AWS - Permissions for a Pentest
 
+{{#include ../../banners/hacktricks-training.md}}
+
 For each AWS account in scope, start with the AWS-managed **arn:aws:iam::aws:policy/**[**ReadOnlyAccess**](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/ReadOnlyAccess) policy. AWS describes it as read-only access to AWS services and resources.<sup>[[1]](#references)</sup>
 
 To run the AWS component of [Blue-CloudPEASS](https://github.com/peass-ng/Blue-CloudPEASS) with IAM Access Analyzer, use the following additions or alternatives:
@@ -17,4 +19,3 @@ To run the AWS component of [Blue-CloudPEASS](https://github.com/peass-ng/Blue-C
 - [4] [Using service-linked roles for IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-using-service-linked-roles.html)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/README.md
index a39fbf7a4c..60a0a8b011 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/README.md
@@ -1,6 +1,7 @@
 # AWS - Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence/README.md
index 83994df58e..360790bb5b 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - API Gateway Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## API Gateway
 
 For more information go to:
@@ -75,4 +77,3 @@ Usage plans use API keys to identify clients and control access to selected API
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md
index 46d1f51150..c512cb7f36 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Cloudformation Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## CloudFormation
 
 For more information, access:
@@ -37,4 +39,3 @@ aws cloudformation update-stack \
 - [3] [update-stack - AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/update-stack.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence/README.md
index 0e8f3c7787..57025f9404 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Cognito Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Cognito
 
 For more information, access:
@@ -48,4 +50,3 @@ Threat protection starts in audit-only mode; full-function enforcement must be a
 - [5] [Advanced security with threat protection - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence/README.md
index f67a428a60..23c952e0a2 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - DynamoDB Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### DynamoDB
 
 For more information access:
@@ -85,4 +87,3 @@ The compromised instances or Lambda functions can periodically check the C2 tabl
 - [8] [Using Amazon DynamoDB in the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-services-dynamodb.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence/README.md
index 49dd9d9c5c..e60ac876cb 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - EC2 Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EC2
 
 For more information check:
@@ -68,4 +70,3 @@ Create a peering connection between the victim VPC and the attacker VPC so he wi
 - [8] [Replace the root volume for an Amazon EC2 instance without stopping it - Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replace-root.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md
index 034c7ae885..93dee44b48 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - EC2 ReplaceRootVolume Task (Stealth Backdoor / Persistence)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse **ec2:CreateReplaceRootVolumeTask** to swap the root EBS volume of a running instance with one restored from an attacker-controlled AMI or eligible snapshot. EC2 reboots the instance automatically and retains its network interfaces and addresses, attached non-root EBS volumes, and IAM profile/policies; an AMI replacement also updates the AMI ID exposed in instance metadata.<sup>[[1]](#references)[[2]](#references)</sup>
 
 ## Requirements
@@ -95,4 +97,3 @@ aws ec2 delete-volume --region $REGION --volume-id $ORIG_VOL
 - [8] [get-console-output — AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/get-console-output.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence/README.md
index e8c58d865b..068c4f2f8c 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - ECR Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECR
 
 For more information check:
@@ -171,4 +173,3 @@ aws ecr get-repository-policy --region $REGION --repository-name ptc2/nginx --qu
 
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence/README.md
index c0c21a847e..7b42b1f70d 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - ECS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECS
 
 For more information check:
@@ -156,4 +158,3 @@ Impact: A protected task is not terminated by ECS scale-in events or deployment
 
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence/README.md
index 5711a43731..ae120bd679 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - EFS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EFS
 
 For more information check:
@@ -26,4 +28,3 @@ An access point can use `/` as the default root directory and enforce a POSIX id
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence/README.md
index dcf2e94c26..5bd1f860e5 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Elastic Beanstalk Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Elastic Beanstalk
 
 For more information check:
@@ -124,4 +126,3 @@ aws elasticbeanstalk update-environment --environment-name my-env --version-labe
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence/README.md
index 18196f7ae6..ea4a660c82 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - IAM Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## IAM
 
 For more information access:
@@ -59,4 +61,3 @@ An IAM OIDC identity provider establishes trust between an OIDC-compatible provi
 - [11] [Create a role for OpenID Connect federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence/README.md
index 02c45295ab..2ec885b561 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - KMS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## KMS
 
 For more information, check:
@@ -46,4 +48,3 @@ aws kms list-grants --key-id <key-id>
 
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md
index 65cb8e482d..b3da59f4a1 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lambda
 
 For more information check:
@@ -159,4 +161,3 @@ aws lambda put-runtime-management-config \
 - [19] [FilterLogEvents - Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md
index 963955ee2d..8d5b06ece2 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md
@@ -1,5 +1,7 @@
 # AWS - Abusing Lambda Extensions
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lambda Extensions
 
 Lambda extensions enhance functions by integrating with **monitoring, observability, security, and governance tools**. For ZIP-based functions, extensions are distributed through [Lambda layers](https://docs.aws.amazon.com/lambda/latest/dg/chapter-layers.html); for container-image functions, they are included in the [image](https://aws.amazon.com/blogs/compute/working-with-lambda-layers-and-extensions-in-container-images/). They operate in two modes: **internal** and **external**.<sup>[[1]](#references)[[4]](#references)[[5]](#references)[[6]](#references)</sup>
@@ -44,4 +46,3 @@ The [**LambdaSpy**](https://github.com/clearvector/lambda-spy) repository contai
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md
index 15429331ab..99942c6f0c 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Alias-Scoped Resource Policy Backdoor (Invoke specific hidden version)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 
 Publish a Lambda version containing attacker logic, then scope a resource-based policy to that published version (or an alias) with the `--qualifier` parameter in `lambda add-permission`. Grant only `lambda:InvokeFunction` on `arn:aws:lambda:REGION:ACCT:function:FN:VERSION` to the attacker principal. A caller must use the full qualified ARN when the permission is version- or alias-scoped, so a primary alias that still points to a clean version can continue serving normal traffic while the attacker invokes the backdoored version directly.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)[[5]](#references)</sup>
@@ -130,4 +132,3 @@ The cleanup command reuses the statement ID and qualifier to remove only the ver
 - [12] [remove-permission — AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/lambda/remove-permission.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md
index 34285325b9..24243da56e 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Async Self-Loop Persistence via Destinations + Recursion Allow
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse Lambda asynchronous destinations together with the Recursion configuration to make a function continually re-invoke itself with no external scheduler (no EventBridge, cron, etc.). By default, Lambda terminates recursive loops, but setting the recursion config to Allow re-enables them.<sup>[[2]](#references)[[3]](#references)</sup> Destinations deliver on the service side for async invokes, so a single seed invoke creates a stealthy, code-free heartbeat/backdoor channel.<sup>[[1]](#references)[[6]](#references)</sup> Optionally throttle with reserved concurrency to keep noise low.<sup>[[7]](#references)</sup>
 
 Notes
@@ -114,4 +116,3 @@ aws iam delete-role-policy --role-name "$ROLE_NAME" --policy-name allow-invoke-s
 - [8] [PutFunctionEventInvokeConfig](https://docs.aws.amazon.com/lambda/latest/api/API_PutFunctionEventInvokeConfig.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md
index 307122c30c..8a623e7094 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Exec Wrapper Layer Hijack (Pre-Handler RCE)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 
 Abuse the environment variable `AWS_LAMBDA_EXEC_WRAPPER` to execute an attacker-controlled wrapper script before the runtime/handler starts. Deliver the wrapper via a Lambda Layer at `/opt/bin/htwrap`, set `AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/htwrap`, and then invoke the function. The wrapper runs inside the function runtime process, inherits the function execution role, and finally `exec`s the real runtime so the original handler still executes normally.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)</sup>
@@ -113,4 +115,3 @@ aws logs filter-log-events --log-group-name "/aws/lambda/$TARGET_FN" --limit 50
 - [8] [filter-log-events — AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/logs/filter-log-events.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md
index 99ab1e1957..f948447e6d 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Layers Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lambda Layers
 
 A Lambda layer is a `.zip` archive that can contain supplementary code or other content, including library dependencies, a [custom runtime](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-custom.html), data, or configuration files.<sup>[[1]](#references)[[10]](#references)</sup>
@@ -151,4 +153,3 @@ aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --state
 - [11] [publish-layer-version — AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/lambda/publish-layer-version.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence/README.md
index 7a43283388..d4e0d20f6b 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Lightsail Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lightsail
 
 For more information check:
@@ -56,4 +58,3 @@ If the assessment includes control of a domain's authoritative DNS zone:
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence/README.md
index 1f55c84862..a8f1423924 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - RDS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## RDS
 
 For more information check:
@@ -39,4 +41,3 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 - [7] [modify-db-snapshot-attribute - AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-snapshot-attribute.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence/README.md
index 6e63d442af..648a408ce5 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - S3 Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## S3
 
 For more information check:
@@ -29,4 +31,3 @@ New S3 buckets use the Bucket owner enforced Object Ownership setting by default
 - [5] [Controlling ownership of objects and disabling ACLs for your bucket - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence/README.md
index 999840d59d..99cd397173 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - SageMaker Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Overview of Persistence Techniques
 
 This section outlines methods for gaining persistence in SageMaker by abusing Lifecycle Configurations (LCCs), including reverse shells, cron jobs, and credential theft via IMDS, together with Model Registry and Canvas configuration backdoors. Notebook-instance LCC scripts run when the instance is created or started, with root access and the notebook instance's IAM execution-role privileges, so an LCC attached to a start hook can reapply changes after restarts.<sup>[[1]](#references)</sup> Most techniques require outbound network access, but usage of services on the AWS control plane can still allow success if the environment is in "VPC-only" mode.
@@ -304,4 +306,3 @@ The role and target model group still need the corresponding cross-account trust
 - [19] [update-space — AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/sagemaker/update-space.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence/README.md
index d874babbdb..33839d7dc2 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Secrets Manager Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Secrets Manager
 
 For more info check:
@@ -265,4 +267,3 @@ aws secretsmanager get-secret-value --region "$R2" --secret-id "$NAME" --query S
 - [14] [Troubleshoot AWS Secrets Manager replication - AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets_troubleshoot.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence/README.md
index 41eb2ac98d..d2587a7bf7 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - SNS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SNS
 
 For more information check:
@@ -127,4 +129,3 @@ Steps (AWS CLI):
 - [10] [Amazon SNS raw message delivery](https://docs.aws.amazon.com/sns/latest/dg/sns-large-payload-raw-message-delivery.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/README.md
index c052062ae8..fce117b76e 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - SQS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SQS
 
 For more information check:
@@ -52,4 +54,3 @@ aws-sqs-orgid-policy-backdoor.md
 - [3] [Tutorial: Using a cross-account Amazon SQS queue as an event source](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-dlq-backdoor-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-dlq-backdoor-persistence.md
index acec8e1a79..fb72edd9a2 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-dlq-backdoor-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-dlq-backdoor-persistence.md
@@ -1,5 +1,7 @@
 # AWS - SQS DLQ Backdoor Persistence via RedrivePolicy/RedriveAllowPolicy
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Amazon SQS moves a message from a source queue to its dead-letter queue (DLQ) after its receive count exceeds `maxReceiveCount`; a low value such as `1` can move a message after one failed receive.<sup>[[1]](#references)[[2]](#references)</sup> An attacker who can change the source queue's `RedrivePolicy` and the DLQ's `RedriveAllowPolicy` can use that routing to divert failed messages into a controlled queue without changing producers or event source mappings.
 
 ## Abused Permissions
@@ -100,4 +102,3 @@ aws sqs set-queue-attributes \
 - [7] [receive-message - AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/sqs/receive-message.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-orgid-policy-backdoor.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-orgid-policy-backdoor.md
index f6037e144a..80f22726ee 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-orgid-policy-backdoor.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-orgid-policy-backdoor.md
@@ -1,5 +1,7 @@
 # AWS - SQS OrgID Policy Backdoor
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 An actor that can edit an SQS queue policy can use a resource-based `Allow` statement to grant message operations to principals from a selected AWS Organization. SQS documents organization-scoped queue-policy conditions using `aws:PrincipalOrgID`; IAM defines this global key as the requester's organization ID and includes it only when the principal belongs to an organization.<sup>[[1]](#references)[[2]](#references)</sup>
 
 Using `Principal: "*"` with the organization condition creates a broad, org-scoped path that reviews looking only for explicit account or role ARNs can miss. AWS also states that policies using `aws:PrincipalOrgID` automatically cover accounts as they are added to or removed from the organization, without manually updating the policy.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence/README.md
index df02ec9ee2..f500c050d9 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - SSM Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SSM
 
 For more information check:
@@ -112,4 +114,3 @@ If `--service-role-arn` is omitted, Systems Manager uses a service-linked role f
 - [16] [describe-instances - AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence/README.md
index 605c310f3c..9aa544c28a 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - Step Functions Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Step Functions
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence/README.md
index 4bbe5b32f9..8190c58a30 100644
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence/README.md
@@ -1,5 +1,7 @@
 # AWS - STS Persistence
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## STS
 
 For more information access:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md
index a06317f55c..ecd4c4d133 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md
@@ -1,6 +1,7 @@
 # AWS - Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation/README.md
index 15542c60e8..4dec8a338d 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - API Gateway Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## API Gateway
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-bedrock-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-bedrock-post-exploitation/README.md
index 858a0bde44..08adbda244 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-bedrock-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-bedrock-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Bedrock Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS - Bedrock Agents Memory Poisoning (Indirect Prompt Injection)
 
 ### Overview
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md
index c781eb3d0a..5a4dead7ba 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - CloudFront Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## CloudFront
 
 For more information check:
@@ -51,4 +53,3 @@ Terraform code for recreating these scenarios is available in the [AWS Attack Sc
 - [10] [How Attackers Can Misuse AWS CloudFront Access to Make It ‘Rain’ Cookies](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md
index a7fd8c110b..283f186c7c 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - CodeBuild Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## CodeBuild
 
 For more information, check:
@@ -108,4 +110,3 @@ aws codebuild delete-source-credentials --arn <value>
 - [14] [GitLab access in CodeBuild](https://docs.aws.amazon.com/codebuild/latest/userguide/access-tokens-gitlab-overview.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md
index 9895c3b721..ee22e2e58a 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md
@@ -1,5 +1,7 @@
 # AWS Codebuild - Token Leakage
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Recover Github/Bitbucket Configured Tokens
 
 First, check whether the account has source credentials configured that could be exposed:<sup>[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-untrusted-pr-webhook-bypass.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-untrusted-pr-webhook-bypass.md
index ae17af646b..974f8bf681 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-untrusted-pr-webhook-bypass.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-untrusted-pr-webhook-bypass.md
@@ -1,5 +1,7 @@
 # AWS CodeBuild - Untrusted PR Webhook Bypass (CodeBreach-style)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 This attack vector appears when a **public-facing PR workflow** is wired to a **privileged CodeBuild project** with weak webhook controls.
 
 If an external attacker can make CodeBuild execute their pull request, they can usually get **arbitrary code execution inside the build** (build scripts, dependency hooks, test scripts, etc.), and then pivot to secrets, IAM credentials, or source-provider credentials.<sup>[[1]](#references)[[6]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation/README.md
index 6d2f2a4837..f8ad006380 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Control Tower Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Control Tower
 
 {{#ref}}
@@ -23,4 +25,3 @@ aws controltower enable-control --control-identifier <control_arn> --target-iden
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation/README.md
index cd1a9a56fd..149db914e3 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - DLM Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Data Lifecycle Manager (DLM)
 
 ### `EC2:DescribeVolumes`, `DLM:CreateLifecyclePolicy`
@@ -94,4 +96,3 @@ A template for the policy document can be seen here. Because this example target
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md
index 4e8b71cdc6..497a2a3c15 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - DynamoDB Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## DynamoDB
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md
index bef4eda5aa..133b86ed3f 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - EC2, EBS, SSM & VPC Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EC2 & VPC
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ami-store-s3-exfiltration.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ami-store-s3-exfiltration.md
index e6dabd36e7..3e464a4350 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ami-store-s3-exfiltration.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ami-store-s3-exfiltration.md
@@ -1,5 +1,7 @@
 # AWS – Covert Disk Exfiltration via AMI Store-to-S3 (CreateStoreImageTask)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 Abuse EC2 `CreateImage` plus `CreateStoreImageTask` to package an EBS-backed AMI—including its EBS snapshot data and most non-Region-specific metadata—into one compressed object in an S3 bucket, then retrieve it out of band. The resulting `.bin` object is an AMI bundle rather than an uncompressed, directly mountable raw disk image; download and process it offline, or restore it with `CreateRestoreImageTask`.<sup>[[1]](#references)[[4]](#references)</sup>
 
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-multi-attach-data-theft.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-multi-attach-data-theft.md
index 1889b3371c..cec5f75dfc 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-multi-attach-data-theft.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-multi-attach-data-theft.md
@@ -1,5 +1,7 @@
 # AWS - Live Data Theft via EBS Multi-Attach
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 Amazon EBS Multi-Attach allows one Provisioned IOPS SSD (`io1` or `io2`) volume to be attached to multiple Nitro instances in the same Availability Zone (AZ), and each attachment has full read/write access to the shared block device.<sup>[[1]](#references)</sup> The attack path below applies that capability to obtain data from a second instance without creating a snapshot, but the result is a live and potentially inconsistent filesystem view.<sup>[[1]](#references)</sup>
 
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md
index f60426b6a4..37e28c7595 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md
@@ -1,5 +1,7 @@
 # AWS - EBS Snapshot Dump
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Checking a snapshot locally
 
 `dsnap` uses the EBS Direct APIs to list and download completed snapshots and can initialize a Vagrantfile for mounting the resulting image. Passing an instance ID can create a temporary snapshot when no existing snapshot is found.<sup>[[2]](#references)[[3]](#references)</sup>
@@ -170,4 +172,3 @@ You can use [CloudCopy](https://github.com/Static-Flow/CloudCopy) to automate th
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md
index ff68bbc586..bdd0a5fe18 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md
@@ -1,5 +1,7 @@
 # AWS - EC2 Instance Connect Endpoint backdoor + ephemeral SSH key injection
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 An EC2 Instance Connect Endpoint (EIC Endpoint) is an identity-aware TCP proxy that can reach private EC2 instances without a public IP address or bastion host.<sup>[[1]](#references)</sup> A short-lived key and an EIC tunnel can therefore provide SSH access to a private Linux instance.<sup>[[4]](#references)[[6]](#references)[[7]](#references)</sup>
 
 - Create an EIC Endpoint in a subnet that can route to the target.<sup>[[1]](#references)[[10]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eip-hijack-impersonation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eip-hijack-impersonation.md
index 4eddb0d2d6..05b2dcf8f9 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eip-hijack-impersonation.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eip-hijack-impersonation.md
@@ -1,5 +1,7 @@
 # AWS - Elastic IP Hijack for Ingress/Egress IP Impersonation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 
 Abuse `ec2:AssociateAddress` (and, when explicitly detaching first, `ec2:DisassociateAddress`) to move an Elastic IP (EIP) from a victim instance or ENI to an attacker-controlled instance or ENI. AWS can disassociate an EIP from its current instance during reassociation; traffic destined for the EIP is translated to the associated resource, while IPv4 traffic leaving a public subnet can use that EIP as its public reply address.<sup>[[1]](#references)[[3]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eni-secondary-ip-hijack.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eni-secondary-ip-hijack.md
index 485ca0a075..6164e8fb97 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eni-secondary-ip-hijack.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eni-secondary-ip-hijack.md
@@ -1,5 +1,7 @@
 # AWS – EC2 ENI Secondary Private IP Hijack (Trust/Allowlist Bypass)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse `ec2:UnassignPrivateIpAddresses` and `ec2:AssignPrivateIpAddresses` to move a victim ENI’s secondary private IP to an attacker ENI in the same subnet/AZ. Secondary private IPv4 addresses are separate from the primary address and can be reassigned between instances; the EC2 API reports that this remapping is asynchronous.<sup>[[1]](#references)[[2]](#references)</sup>
 
 When a service’s inbound policy allows a specific private IPv4 address, moving that address can make traffic from the attacker match the same `/32` source rule. This is an address reassignment at the VPC/ENI layer, not arbitrary packet-source spoofing.<sup>[[1]](#references)[[2]](#references)[[5]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md
index 79f0ff815b..8f638c49cc 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md
@@ -1,5 +1,7 @@
 # AWS - Malicious VPC Mirror
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 **Check** [**https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws**](https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws) **for further details of the attack!**
 
 Passive network inspection in a cloud environment can require broad network changes to monitor hosts without making monitoring noisy or easy to bypass. AWS VPC Traffic Mirroring copies inbound and outbound traffic from an instance network interface without an agent and can deliver matching packets to a security or monitoring appliance such as an IDS for analysis.<sup>[[1]](#references)[[7]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-managed-prefix-list-backdoor.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-managed-prefix-list-backdoor.md
index 3670405554..79d0924076 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-managed-prefix-list-backdoor.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-managed-prefix-list-backdoor.md
@@ -1,5 +1,7 @@
 # AWS - Security Group Backdoor via Managed Prefix Lists
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 Customer-managed prefix lists are reusable sets of CIDR blocks that security-group rules can reference. When entries change, AWS creates a new version and resources that reference the list use the latest version. An identity that can modify the list can therefore add an attacker-controlled CIDR and widen every referencing security group without changing its rule.<sup>[[1]](#references)[[2]](#references)</sup>
 
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-endpoint-egress-bypass.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-endpoint-egress-bypass.md
index c789285fb5..c2065a1dc1 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-endpoint-egress-bypass.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-endpoint-egress-bypass.md
@@ -1,5 +1,7 @@
 # AWS – Egress Bypass from Isolated Subnets via VPC Endpoints
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 
 This technique abuses VPC endpoints to create service-specific paths from subnets without Internet Gateways or NAT. Gateway endpoints (for example, S3) add prefix-list routes to selected route tables; interface endpoints (for example, `execute-api`, `secretsmanager`, `ssm`, and `sts`) create requester-managed network interfaces with private IPs protected by security groups. Interface endpoint connections stay on the AWS network, and both endpoint types reach only the selected service rather than providing arbitrary Internet access.<sup>[[1]](#references)[[2]](#references)[[7]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-flow-logs-cross-account-exfiltration.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-flow-logs-cross-account-exfiltration.md
index 0f0924467c..4061535d6b 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-flow-logs-cross-account-exfiltration.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-flow-logs-cross-account-exfiltration.md
@@ -1,5 +1,7 @@
 # AWS - VPC Flow Logs Cross-Account Exfiltration to S3
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Summary
 An attacker who can create VPC Flow Logs can point the delivery destination at an S3 bucket in another account whose bucket policy permits the log-delivery service to write. VPC Flow Logs capture network-flow metadata for a VPC, subnet, or network interface and deliver it to S3 in batches, making this an ongoing cross-account exfiltration path.<sup>[[1]](#references)[[2]](#references)[[7]](#references)</sup>
 
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md
index 13c6e1eaae..8cfda95584 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - ECR Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECR
 
 For more information, see the ECR enumeration page.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md
index 464ffefc2d..7a7c217c43 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - ECS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECS
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation/README.md
index 4105f57a53..79552c3c0a 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - EFS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EFS
 
 For more information check:
@@ -64,4 +66,3 @@ aws efs delete-access-point --access-point-id <value>
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md
index a9eb0b2804..36ad108a1d 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - EKS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EKS
 
 For more information check
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation/README.md
index c362804045..882b062a57 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Elastic Beanstalk Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Elastic Beanstalk
 
 For more information:
@@ -98,4 +100,3 @@ aws elasticbeanstalk update-tags-for-resource \
 - [15] [update-tags-for-resource - AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-tags-for-resource.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md
index 7086348fd5..2c796cb54c 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - IAM Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## IAM
 
 For more information about IAM access:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation/README.md
index 262aadebb2..fb127295c2 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - KMS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## KMS
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md
index 67a13d49f0..a15d584fbe 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lambda
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md
index 1d65104c04..b5e8bcde34 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md
@@ -1,5 +1,7 @@
 # AWS Lambda – EFS Mount Injection via UpdateFunctionConfiguration (Data Theft)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse `lambda:UpdateFunctionConfiguration` to attach an existing EFS Access Point to a Lambda, then deploy trivial code that lists/reads files from the mounted path to exfiltrate shared secrets/config that the function previously couldn’t access. Lambda exposes an EFS access point through a local path under `/mnt/` and requires the file system to be reachable from the function's VPC.<sup>[[1]](#references)</sup>
 
 ## Requirements
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md
index bc9c1c97c4..5c04c9bb26 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md
@@ -1,5 +1,7 @@
 # AWS - Hijack Event Source Mapping to Redirect Stream/SQS/Kinesis to Attacker Lambda
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse `UpdateEventSourceMapping` to change the target Lambda function of an existing Event Source Mapping (ESM) so that records from DynamoDB Streams, Kinesis, or SQS are delivered to an attacker-controlled function. This silently diverts live data without touching producers or the original function code.<sup>[[1]](#references)[[2]](#references)</sup>
 
 ## Impact
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md
index 4b53e13891..d3ff529be2 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Function URL Public Exposure (AuthType NONE + Public Invoke Policy)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Turn a private Lambda Function URL into a public unauthenticated endpoint by switching its `AuthType` to `NONE` and attaching a resource-based policy that grants URL invocation to everyone. With the required public policy statements in place, anyone who knows the URL can invoke the function without IAM authentication, potentially exposing sensitive backend operations when the function fronts internal logic.<sup>[[1]](#references)[[2]](#references)</sup>
 
 ## Abusing it
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md
index 294c388747..d483df6922 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md
@@ -1,5 +1,7 @@
 # AWS Lambda – Log Siphon via LoggingConfig.LogGroup Redirection
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse `lambda:UpdateFunctionConfiguration`'s `LoggingConfig.LogGroup` setting to redirect a function's subsequent application and system logs to a chosen CloudWatch Logs log group. Lambda normally writes to `/aws/lambda/<function>`, but `LogGroup` accepts an existing or new custom group.<sup>[[1]](#references)[[2]](#references)</sup> This is a configuration-only change and does not require a code deployment.<sup>[[2]](#references)</sup> When the CLI sets a custom group, the function execution role still needs `logs:PutLogEvents`; the AWS managed `AWSLambdaBasicExecutionRole` policy grants that plus `logs:CreateLogGroup` and `logs:CreateLogStream`.<sup>[[1]](#references)[[3]](#references)</sup> If the function prints secrets/request bodies or crashes with stack traces, those messages can be collected from the sink when the reader can read the group.<sup>[[4]](#references)</sup>
 
 ## Required permissions
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md
index 486e0ce2f5..3a5d865820 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md
@@ -1,5 +1,7 @@
 # AWS Lambda – Runtime Pinning/Rollback Abuse via PutRuntimeManagementConfig
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Abuse `lambda:PutRuntimeManagementConfig` to pin a function version to a specific runtime version (`Manual`) or defer runtime updates until the function is updated (`FunctionUpdate`). `Manual` uses the selected runtime indefinitely, while `FunctionUpdate` applies the latest runtime when the function is updated.<sup>[[1]](#references)[[2]](#references)</sup>
 
 Manual mode can leave a function on an outdated or vulnerable runtime without automatic runtime updates.<sup>[[1]](#references)[[2]](#references)</sup> In a compromise, that can preserve compatibility with malicious layers or wrappers and aid exploitation or long-term persistence.
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md
index 4719a84b69..5df8712d1f 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md
@@ -1,5 +1,7 @@
 # AWS Lambda – VPC Egress Bypass by Detaching `VpcConfig`
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Force a Lambda function out of a customer VPC by updating its `VpcConfig` with empty `SubnetIds` and `SecurityGroupIds`. AWS documents this exact command for detaching a function; Lambda functions have public-internet connectivity by default, while a function attached to a customer VPC can reach resources and the internet only through that VPC.<sup>[[1]](#references)[[2]](#references)</sup> This changes the customer-VPC attachment, not the Lambda service's underlying managed VPC.<sup>[[1]](#references)</sup>
 
 ## Abusing it
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md
index ea792e3f3b..8249225b66 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md
@@ -1,5 +1,7 @@
 # AWS - Steal Lambda Requests
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lambda Flow
 
 <figure><img src="../../../../images/image (341).png" alt=""><figcaption><p><a href="https://unit42.paloaltonetworks.com/wp-content/uploads/2019/10/lambda_poc_2_arch.png">https://unit42.paloaltonetworks.com/wp-content/uploads/2019/10/lambda_poc_2_arch.png</a><sup>[[2]](#references)</sup></p></figcaption></figure>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation/README.md
index 2dd31b1771..a62627fa94 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Lightsail Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lightsail
 
 For more information, check:
@@ -42,4 +44,3 @@ Check out the Lightsail privesc options to learn different ways to access potent
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
index 4b29bc34f2..f4fa9c371a 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-mwaa-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS MWAA Execution Role Account Wildcard Vulnerability
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## The Vulnerability
 
 MWAA's execution role (the IAM role that Airflow workers use to access AWS resources) requires this SQS permission for task queueing.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation/README.md
index 21a00b78de..da3ad801e7 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Organizations Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Organizations
 
 For more info about AWS Organizations check:
@@ -30,4 +32,3 @@ The account must have the information required to operate as a standalone accoun
 - [2] [leave-organization — AWS CLI 2 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/organizations/leave-organization.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md
index f1793a6fc4..716a2db772 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - RDS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## RDS
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
index f79c1429d1..7400ceae5b 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - S3 Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## S3
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md
index 4c150d9f0c..beabe0875e 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - SageMaker Post-Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SageMaker endpoint data siphon via UpdateEndpoint DataCaptureConfig
 
 Abuse SageMaker endpoint management to enable input and output capture to an attacker‑controlled S3 bucket without changing the model or container. `DataCaptureConfig` supports selecting input/output boundaries, sampling requests, and storing the capture at an S3 destination; `UpdateEndpoint` deploys the new endpoint configuration with no availability loss by default.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/feature-store-poisoning.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/feature-store-poisoning.md
index 4ba7503f2b..c894f9e778 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/feature-store-poisoning.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/feature-store-poisoning.md
@@ -1,5 +1,7 @@
 # SageMaker Feature Store online store poisoning
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 An identity authorized for `sagemaker:PutRecord` can submit a full record to an online-enabled Feature Group. If its event time is newer, the record becomes the latest value in the low-latency OnlineStore used by real-time inference; an identity authorized for `sagemaker:GetRecord` can read the latest record as well. This data-plane path targets feature values directly and does not require permissions to modify a model or endpoint.<sup>[[1]](#references)[[2]](#references)[[5]](#references)[[6]](#references)[[8]](#references)</sup>
 
 ## Requirements
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation/README.md
index e72217d6b3..81f76f502e 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Secrets Manager Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Secrets Manager
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation/README.md
index 5f553bfdb2..f3fca62842 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - SES Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SES
 
 For more information check:
@@ -109,4 +111,3 @@ The SES sandbox is Region-specific and limits sending to verified recipients (or
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/README.md
index 4ca08aa0b3..abde7b9ec0 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - SNS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SNS
 
 For more information:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-data-protection-bypass.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-data-protection-bypass.md
index 13905a89a1..88f1943f70 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-data-protection-bypass.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-data-protection-bypass.md
@@ -1,5 +1,7 @@
 # AWS - SNS Message Data Protection Bypass via Policy Downgrade
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 If you have `sns:PutDataProtectionPolicy` on a topic, you can replace an outbound Deidentify/Deny policy with an inbound Audit policy—or remove the policy—to leave no outbound mask or block. SNS defines Inbound for Publish requests and Outbound for notification deliveries; Audit does not interrupt publishing or delivery, while Deidentify masks or redacts and Deny blocks or fails delivery, so sensitive values such as credit card numbers can reach a subscription unmodified when the outbound control is gone.<sup>[[1]](#references)[[3]](#references)[[5]](#references)[[7]](#references)</sup>
 
 > **Availability note:** AWS says SNS Message Data Protection is no longer available to new customers. This procedure therefore applies only where the feature is already available or configured.<sup>[[6]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-fifo-replay-exfil.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-fifo-replay-exfil.md
index be518003ac..b91d070a5d 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-fifo-replay-exfil.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-fifo-replay-exfil.md
@@ -1,5 +1,7 @@
 # SNS FIFO Archive Replay Exfiltration via Attacker SQS FIFO Subscription
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Amazon SNS FIFO topics can archive published messages with `ArchivePolicy`; a subscriber can use a `ReplayPolicy` to replay archived messages to its endpoint, including messages published before that subscription existed. Replayed messages include the `Replayed` attribute in the SNS notification.<sup>[[1]](#references)[[2]](#references)</sup>
 
 - Service: Amazon SNS (FIFO topics) + Amazon SQS (FIFO queues)
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md
index ede3030ba9..4180c98789 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md
@@ -1,5 +1,7 @@
 # AWS - SNS to Kinesis Firehose Exfiltration (Fanout to S3)
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 Amazon SNS supports a `firehose` subscription whose endpoint is a Kinesis Data Firehose delivery-stream ARN. The subscription requires a role trusted by `sns.amazonaws.com` with permission to write to that stream; Firehose separately assumes a delivery role with S3 permissions. Firehose buffers records into S3 objects and retries DirectPut S3 delivery for up to 24 hours, so this path can persist messages but delivery is not guaranteed if failures outlast retention.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)[[9]](#references)</sup>
 
 Used offensively, this lets an attacker attach an attacker-controlled delivery stream to a victim standard topic.<sup>[[1]](#references)[[2]](#references)</sup> The managed path can be relatively low-noise because no publisher code or publishing client configuration needs to change.
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/README.md
index ce8e3160b2..de851ace35 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - SQS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SQS
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-dlq-redrive-exfiltration.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-dlq-redrive-exfiltration.md
index f231d5788a..8182fc478e 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-dlq-redrive-exfiltration.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-dlq-redrive-exfiltration.md
@@ -1,5 +1,7 @@
 # AWS – SQS DLQ Redrive Exfiltration via StartMessageMoveTask
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Description
 
 Abuse SQS message move tasks to move accumulated messages from a victim's Dead-Letter Queue (DLQ) to an attacker-controlled queue using `sqs:StartMessageMoveTask`. AWS exposes this as an asynchronous redrive operation with an optional custom destination queue; using an attacker-controlled destination turns the recovery feature into a bulk data-transfer primitive.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-sns-injection.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-sns-injection.md
index f9c8d72f04..1d4c399f7e 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-sns-injection.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-sns-injection.md
@@ -1,5 +1,7 @@
 # AWS – SQS Cross-/Same-Account Injection via SNS Subscription + Queue Policy
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Description
 
 An SQS queue resource policy can allow an attacker-controlled SNS topic to publish messages into a victim SQS queue, provided the policy grants `sqs:SendMessage` to SNS and constrains the topic with `aws:SourceArn`.<sup>[[1]](#references)</sup> When the queue owner creates the subscription, SNS confirms it automatically; when a principal that does not own the queue creates it, SNS sends a subscription-confirmation message to the queue, and the subscription owner must confirm with its token before notifications flow.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)</sup> This enables unsolicited message injection that downstream consumers may implicitly trust.
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation/README.md
index bb626e191d..3932f3092c 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - SSO & identitystore Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SSO & identitystore
 
 For more information check:
@@ -28,4 +30,3 @@ aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation/README.md
index 007c8ac180..1e640466d5 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - Step Functions Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Step Functions
 
 For more information about this AWS service, check:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation/README.md
index 6cc217d32d..f5d9f04b34 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - STS Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## STS
 
 For more information:
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation/README.md
index 4d7bfcc261..9a3cb5acbf 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - VPN Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## VPN
 
 For more information:
@@ -12,4 +14,3 @@ For more information:
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-workmail-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-workmail-post-exploitation/README.md
index 66fdd8d371..c42cf1f595 100644
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-workmail-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-workmail-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # AWS - WorkMail Post Exploitation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Abusing WorkMail to bypass SES sandbox
 
 Even if SES is stuck in the **sandbox** (only verified email addresses/domains or the mailbox simulator, 200 messages/24h, 1 message/s), WorkMail does not impose that same verified-recipient gate, although its own quotas still apply.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup> An attacker with compromised long-term keys and control of a sending domain can spin up disposable mail infrastructure and, once provisioning and verification complete, start sending immediately:<sup>[[1]](#references)[[5]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md
index dd0b1edc14..4cb29faa5f 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md
@@ -1,5 +1,7 @@
 # AWS - Privilege Escalation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## AWS Privilege Escalation
 
 The way to escalate your privileges in AWS is to have enough permissions to be able to, somehow, access other roles/users/groups privileges. Chaining escalations until you have admin access over the organization.
@@ -28,4 +30,3 @@ The way to escalate your privileges in AWS is to have enough permissions to be a
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc/README.md
index 849ea2f897..510271fdef 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Apigateway Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Apigateway
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc/README.md
index 6f724a293d..cf9bed0902 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - AppRunner Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AppRunner
 
 ### `iam:PassRole`, `apprunner:CreateService`
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-privesc/README.md
index 67782eb28d..49e12e6eda 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-bedrock-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Bedrock PrivEsc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Amazon Bedrock AgentCore
 
 ### `bedrock-agentcore:StartCodeInterpreterSession` + `bedrock-agentcore:InvokeCodeInterpreter` - Code Interpreter Execution-Role Pivot
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc/README.md
index a40ef00aed..35f8dba51e 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Chime Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### chime:CreateApiKey
 
 The `chime:CreateApiKey` IAM action is a write permission that creates a SCIM access key for an Amazon Chime account and its Okta configuration.<sup>[[1]](#references)</sup>
@@ -17,4 +19,3 @@ TODO
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md
index 6083a15ee5..efdda9aea5 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Cloudformation Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## cloudformation
 
 For more information about cloudformation check:
@@ -180,4 +182,3 @@ class CdkTestStack(Stack):
 - [18] [AWS CDK ArtifactManifest API reference](https://docs.aws.amazon.com/cdk/api/v2/docs/%40aws-cdk_cloud-assembly-schema.ArtifactManifest.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md
index feb3c9875a..f486976362 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md
@@ -1,5 +1,7 @@
 # iam:PassRole, cloudformation:CreateStack, and cloudformation:DescribeStacks
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 An attacker could for example use a **CloudFormation template** that generates **keys for an admin** user like:<sup>[[1]](#references)[[4]](#references)[[5]](#references)</sup>
 
 ```json
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md
index 61daa91daa..bb61841171 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - CloudFront Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## CloudFront
 
 ### `cloudfront:UpdateDistribution` & `cloudfront:GetDistributionConfig`
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/README.md
index aec7a430bf..1a034897b7 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Codebuild Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## codebuild
 
 Get more info in:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc/README.md
index f753a3f2be..958e3daf7a 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Codepipeline Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## codepipeline
 
 For more info about codepipeline check:
@@ -48,4 +50,3 @@ See the [AWS `PollForJobs` API reference](https://docs.aws.amazon.com/codepipeli
 - [12] [Create the CodePipeline service role - AWS CodePipeline](https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-service-role.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md
index 16b2bce5a6..cd8f6e3e89 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Codestar Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Codestar
 
 > [!WARNING]
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md
index 376395b0b3..85072fa140 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md
@@ -1,5 +1,7 @@
 # codestar:CreateProject, codestar:AssociateTeamMember
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 > [!WARNING]
 > AWS lists AWS CodeStar as fully shut down as of July 25, 2024. Treat this policy as a historical example for reviewing legacy configurations; it is not a current exploitation procedure.<sup>[[3]](#references)</sup>
 
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md
index 9c2f5131df..af26f91efb 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md
@@ -1,5 +1,7 @@
 # iam:PassRole, codestar:CreateProject
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 > [!WARNING]
 > AWS discontinued support for creating and viewing AWS CodeStar projects on July 31, 2024; after that date, new projects cannot be created. Treat this as a historical privilege-escalation technique and verify the target account's service availability before relying on it.<sup>[[1]](#references)</sup>
 
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc/README.md
index 8b9a1b00fd..f1b6cc1b3b 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Cognito Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Cognito
 
 For more info about Cognito check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc/README.md
index cbdf55ec99..be22c9fc20 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Datapipeline Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## datapipeline
 
 For more info about datapipeline check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc/README.md
index 324619f84d..e1f88c9ed7 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Directory Services Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Directory Services
 
 For more info about directory services check:
@@ -40,4 +42,3 @@ The documented sequence is to create the access URL, enable console access, and
 - [6] [Granting AWS Managed Microsoft AD users and groups access to AWS resources with IAM roles](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_roles.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc/README.md
index fdc67c4696..f8718a7705 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - DynamoDB Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## dynamodb
 
 For more info about dynamodb check:
@@ -89,4 +91,3 @@ As far as I know there is **no other direct way to escalate privileges in AWS ju
 - [11] [Loading a parameter from a file in the AWS CLI - AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-parameters-file.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md
index bb6449eda5..a5c1eeebdc 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - EBS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EBS
 
 ### `ebs:ListSnapshotBlocks`, `ebs:GetSnapshotBlock`, `ec2:DescribeSnapshots`
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md
index 983ba96795..457428ba8c 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - EC2 Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EC2
 
 For more **info about EC2** check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc/README.md
index cf2a602784..fdd0755b8d 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - ECR Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECR
 
 ### `ecr:GetAuthorizationToken`, `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/README.md
index 018ecae8eb..470538c48a 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - ECS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECS
 
 More **info about ECS** in:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc/README.md
index 6a36bc43ea..7e861b8eb0 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - EFS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EFS
 
 More **info about EFS** in:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc/README.md
index 4b5470bc21..a9c5db142d 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Elastic Beanstalk Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Elastic Beanstalk
 
 More **info about Elastic Beanstalk** in:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc/README.md
index c0d4b0fd9e..36b8552885 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - EMR Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EMR
 
 More **info about EMR** in:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift/README.md
index 75d78af23f..8fbed447dd 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift/README.md
@@ -1,5 +1,7 @@
 # AWS - Gamelift
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### `gamelift:RequestUploadCredentials`
 
 The `gamelift:RequestUploadCredentials` action grants permission to retrieve fresh upload credentials for a new game build.<sup>[[1]](#references)[[4]](#references)</sup>
@@ -20,4 +22,3 @@ aws gamelift request-upload-credentials \
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/README.md
index 12b3365a41..9d815fc9d6 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Glue Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## glue
 
 ### `iam:PassRole`, `glue:CreateDevEndpoint`, (`glue:GetDevEndpoint` | `glue:GetDevEndpoints`)
@@ -110,4 +112,3 @@ With `glue:UpdateJob` alone, a caller can replace an existing job definition; if
 - [16] [Retrieve security credentials from instance metadata - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-security-credentials.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md
index 395c646dad..7d59982f16 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - IAM Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## IAM
 
 For more info about IAM check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc/README.md
index 4afea87612..3dc9f5f0b5 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - KMS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## KMS
 
 For more info about KMS check:
@@ -136,4 +138,3 @@ For more information check:
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md
index c2f792b04a..f6404fa2b3 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## lambda
 
 More info about lambda in:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc/README.md
index 328c3dd80c..6870f9e9a3 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Lightsail Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Lightsail
 
 For more information about Lightsail check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc/README.md
index 2ed3929004..46e2400145 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Macie Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Macie
 
 For more information about Macie check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc/README.md
index 35e750c465..c89bfb0123 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Mediapackage Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 The following MediaPackage actions appear in a reference list of AWS API calls that return credentials.<sup>[[1]](#references)</sup>
 
 ### `mediapackage:RotateChannelCredentials`
@@ -28,4 +30,3 @@ aws mediapackage rotate-ingest-endpoint-credentials --id test --ingest-endpoint-
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc/README.md
index a5ccd9972c..c433167a4c 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - MQ Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## MQ
 
 For more information about MQ check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md
index 7cac399c04..2638042401 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - MSK Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## MSK
 
 For more information about MSK (Kafka) check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md
index 883ec19ea7..d5f58fcdd6 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Organizations Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Organizations
 
 For more information check:
@@ -19,4 +21,3 @@ To [**learn how check this page**](../../index.html#compromising-the-organizatio
 - [2] [Accessing a member account that has OrganizationAccountAccessRole with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access-cross-account-role.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc/README.md
index 7368323e55..d87765c62c 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - RDS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## RDS - Relational Database Service
 
 For more information about RDS check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc/README.md
index db3e5f33c8..4cda1a5adb 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Redshift Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Redshift
 
 For more information about Redshift enumeration check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md
index aa99a622a1..4e67878e06 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - S3 Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## S3
 
 ### `s3:PutBucketNotification`, `s3:PutObject`, `s3:GetObject`
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc/README.md
index 2f17eb1bf7..2baefadf16 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc/README.md
@@ -1,4 +1,6 @@
-## AWS - Sagemaker Privesc
+# AWS - Sagemaker Privesc
+
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ### `iam:PassRole` , `sagemaker:CreateNotebookInstance`, `sagemaker:CreatePresignedNotebookInstanceUrl`
 
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc/README.md
index 58a9e96636..9b1f6d5f60 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Secrets Manager Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Secrets Manager
 
 For more info about secrets manager check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc/README.md
index b7c0a4865a..dc6975d53e 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - SNS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SNS
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc/README.md
index d98640dc4b..9dd41c9822 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - SQS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SQS
 
 For more information check:
@@ -56,4 +58,3 @@ aws sqs change-message-visibility --queue-url <value> --receipt-handle <value> -
 - [7] [ChangeMessageVisibility — Amazon Simple Queue Service API Reference](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ChangeMessageVisibility.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc/README.md
index 829eb3a4bd..9147c72a3a 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - SSM Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SSM
 
 For more info about SSM check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc/README.md
index 2fd340976c..4f17d65456 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - SSO & identitystore Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS Identity Center / AWS SSO
 
 For more information about AWS Identity Center / AWS SSO check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc/README.md
index da76e8f4ea..8f3b00d3cf 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - Step Functions Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Step Functions
 
 For more information about this AWS service, check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc/README.md
index f0fa3b5a45..958977e947 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - STS Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## STS
 
 ### `sts:AssumeRole`
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md
index 8b17eeef67..40c254e072 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - WorkDocs Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## WorkDocs
 
 For more info about WorkDocs check:
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc/README.md
index e812c52898..269c28042e 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc/README.md
@@ -1,5 +1,7 @@
 # AWS - EventBridge Scheduler Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EventBridge Scheduler
 
 More info EventBridge Scheduler in:
@@ -50,4 +52,3 @@ aws scheduler create-schedule \
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md
index 26b2387c0a..e463c3d5b2 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md
@@ -1,5 +1,7 @@
 # AWS - Route53 Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 For more information about Route53 check:
 
 {{#ref}}
diff --git a/src/pentesting-cloud/aws-security/aws-services/README.md b/src/pentesting-cloud/aws-security/aws-services/README.md
index bd9fd891f6..c8827c7165 100644
--- a/src/pentesting-cloud/aws-security/aws-services/README.md
+++ b/src/pentesting-cloud/aws-security/aws-services/README.md
@@ -1,5 +1,7 @@
 # AWS - Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Types of services
 
 ### Container services
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md
index 4d1d09ec95..41e0ab06f9 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md
@@ -1,5 +1,7 @@
 # AWS - API Gateway Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## API Gateway
 
 ### Basic Information
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md
index 0463257228..e07656a698 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-bedrock-enum.md
@@ -1,5 +1,7 @@
 # AWS - Bedrock
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Overview
 
 Amazon Bedrock is a fully managed service that makes it easy to build and scale generative AI applications using foundation models (FMs) from leading AI startups and Amazon. Bedrock provides access to various FMs through a single API, allowing developers to choose the most suitable model for their specific use cases without managing the underlying infrastructure.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md b/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md
index c32b4d7300..3abfdc7e72 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md
@@ -1,5 +1,7 @@
 # AWS - Certificate Manager (ACM) & Private Certificate Authority (PCA)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **AWS Certificate Manager (ACM)** is a service for provisioning, managing, and deploying SSL/TLS certificates. ACM is intended for AWS integrated services such as **Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway**; exportable ACM certificates can also be used outside those integrations.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md
index eca2017545..667e215fd5 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md
@@ -1,5 +1,7 @@
 # AWS - CloudFormation & Codestar Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## CloudFormation
 
 AWS CloudFormation is a service designed to **streamline the management of AWS resources**. It enables users to focus more on their applications running in AWS by **minimizing the time spent on resource management**. The core feature of this service is the **template**—a descriptive model of the desired AWS resources. Once this template is provided, CloudFormation is responsible for the **provisioning and configuration** of the specified resources. This automation facilitates a more efficient and error-free management of AWS infrastructure.<sup>[[1]](#references)</sup>
@@ -85,4 +87,3 @@ In the following page you can check how to **abuse codestar permissions to escal
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md
index 738445dc24..8283da2307 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md
@@ -1,5 +1,7 @@
 # AWS - CloudFront Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## CloudFront
 
 CloudFront is AWS's **content delivery network that speeds up distribution** of static and dynamic content through a worldwide network of edge locations. When a viewer requests content served through CloudFront, the request is routed to the edge location that can provide the lowest latency and best performance.<sup>[[1]](#references)</sup>
@@ -63,4 +65,3 @@ aws cloudfront list-distributions | jq ".DistributionList.Items[] | .Id, .Origin
 - [14] [Access logs (standard logs)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md
index b225b33dfb..89cfe53e1e 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md
@@ -1,5 +1,7 @@
 # AWS - CloudHSM Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## HSM - Hardware Security Module
 
 AWS CloudHSM provides general-purpose, single-tenant hardware security modules (HSMs) in the AWS Cloud. FIPS-mode clusters use HSMs validated at FIPS 140-2 Level 3 or FIPS 140-3 Level 3; non-FIPS clusters support the AWS CloudHSM algorithms regardless of FIPS approval.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md
index afbf9246d7..f041ccc6d5 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md
@@ -1,5 +1,7 @@
 # AWS - Codebuild Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## CodeBuild
 
 AWS **CodeBuild** is recognized as a **fully managed continuous integration service**. The primary purpose of this service is to automate the sequence of compiling source code, executing tests, and packaging the software for deployment purposes. The predominant benefit offered by CodeBuild lies in its ability to alleviate the need for users to provision, manage, and scale their build servers. This convenience is because the service itself manages these tasks. Essential features of AWS CodeBuild encompass:<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md
index e26d73c1e0..f7d0649fe0 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Cognito Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Cognito
 
 Amazon Cognito is utilized for **authentication, authorization, and user management** in web and mobile applications. It allows users the flexibility to sign in either directly using a **user name and password** or indirectly through a **third party**, including Facebook, Amazon, Google, or Apple.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -113,4 +115,3 @@ When a public app client permits self-registration, its **App client ID** (often
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md
index cdd91aa32a..efcfd95771 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md
@@ -1,5 +1,7 @@
 # Cognito Identity Pools
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Identity pools let applications exchange guest or federated identities for temporary AWS credentials. Those credentials can be used to call AWS services such as Amazon S3 and DynamoDB, subject to the IAM role and session policies.<sup>[[1]](#references)[[9]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md
index 362869a1fb..457750e1dc 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md
@@ -1,5 +1,7 @@
 # Cognito User Pools
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 A user pool is a user directory in Amazon Cognito. With a user pool, your users can **sign in to your web or mobile app** through Amazon Cognito, **or federate** through a **third-party** identity provider (IdP). Whether your users sign in directly or through a third party, all members of the user pool have a directory profile that you can access through an SDK.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md b/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md
index 8e659b324f..9387355b0d 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md
@@ -1,5 +1,7 @@
 # AWS - DataPipeline, CodePipeline & CodeCommit Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## DataPipeline
 
 AWS Data Pipeline is designed to facilitate the **access, transformation, and efficient transfer** of data at scale. It allows the following operations to be performed:<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md
index 70f323cea1..eb923811b0 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md
@@ -1,5 +1,7 @@
 # AWS - Directory Services / WorkDocs Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Directory Services
 
 AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) is a managed Microsoft Active Directory service in AWS. It runs domain controllers in your VPC while AWS manages monitoring, recovery, replication, snapshots, and software updates.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum/README.md
index 6aca2347dd..2717f17f3a 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - DocumentDB Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## DocumentDB
 
 Amazon DocumentDB is AWS's fully managed document database with MongoDB compatibility. Its compatibility layer is intended to let applications continue using familiar MongoDB drivers and tools while AWS handles the database service's operation and scaling.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md
index eaa9fc9172..eb0f37573a 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md
@@ -1,5 +1,7 @@
 # AWS - DynamoDB Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## DynamoDB
 
 ### Basic Information
@@ -204,4 +206,3 @@ Therefore, a login like the previous one can be bypassed with something like:
 - [23] [Creating backups of DynamoDB tables with AWS Backup](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/CreateBackupAWS.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md
index 2d8e478d53..9978448ddb 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - EC2, EBS, ELB, SSM, VPC & VPN Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## VPC & Networking
 
 Learn what a VPC is and about its components in:
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md
index 8a8748b8e8..b2a18ea5fb 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md
@@ -1,5 +1,7 @@
 # AWS - Nitro Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 AWS Nitro is a suite of **innovative technologies** that form the underlying platform for AWS EC2 instances. Introduced by Amazon to **enhance security, performance, and reliability**, Nitro leverages custom **hardware components and a lightweight hypervisor**. It abstracts much of the traditional virtualization functionality to dedicated hardware and software, **minimizing the attack surface** and improving resource efficiency. By offloading virtualization functions, Nitro allows EC2 instances to deliver **near bare-metal performance**, making it particularly beneficial for resource-intensive applications. Additionally, the Nitro Security Chip specifically ensures the **security of the hardware and firmware**, further solidifying its robust architecture.<sup>[[3]](#references)[[21]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md
index 727158993f..e43089ae38 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md
@@ -1,5 +1,7 @@
 # AWS - VPC & Networking Basic Information
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS Networking in a Nutshell
 
 A **VPC** is a logically isolated virtual network that you define in AWS. It has one or more network CIDR blocks and can contain subnets, route tables, network ACLs, security groups, gateways, and IP addresses.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md
index c9f2762619..5cefce74b5 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md
@@ -1,5 +1,7 @@
 # AWS - ECR Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## ECR
 
 ### Basic Information
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md
index e714389625..f4ee18c514 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md
@@ -1,5 +1,7 @@
 # AWS - ECS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## ECS
 
 ### Basic Information
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md
index 987d179c1c..d62030e3a5 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md
@@ -1,5 +1,7 @@
 # AWS - EFS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## EFS
 
 ### Basic Information
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md
index d11b3df455..448cbc20ae 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md
@@ -1,5 +1,7 @@
 # AWS - EKS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## EKS
 
 Amazon Elastic Kubernetes Service (Amazon EKS) is a managed Kubernetes service that simplifies deploying, managing, and scaling containerized applications in AWS. In standard EKS mode, AWS manages the Kubernetes control plane; EKS Auto Mode extends that management to the nodes and automates infrastructure provisioning, scaling, optimization, and operating-system patching.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md
index 89d5a2681a..4c05b0a3e9 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md
@@ -1,5 +1,7 @@
 # AWS - Elastic Beanstalk Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Elastic Beanstalk
 
 Amazon Elastic Beanstalk provides a simplified platform for **deploying, managing, and scaling web applications and services**. It supports a variety of programming languages and frameworks, such as Java, .NET, PHP, Node.js, Python, Ruby, and Go, as well as Docker containers. The service is compatible with widely-used servers including Apache, Nginx, Passenger, and IIS.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md b/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md
index fc063d690a..dbe5b272e0 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md
@@ -1,5 +1,7 @@
 # AWS - ElastiCache
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## ElastiCache
 
 AWS ElastiCache is a fully **managed in-memory data store and cache service** that provides high-performance, low-latency, and scalable solutions for applications. It supports popular open-source in-memory engines: **Valkey, Redis OSS, and Memcached**. ElastiCache **simplifies** the **setup**, **management**, and **maintenance** of these engines, including provisioning, patching, and monitoring; backups and snapshots apply to Valkey and Redis OSS rather than Memcached.<sup>[[1]](#references)[[2]](#references)[[11]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md
index 44d0ef4e22..64096fddf2 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md
@@ -1,5 +1,7 @@
 # AWS - EMR Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## EMR
 
 Amazon Elastic MapReduce (Amazon EMR) is a managed cluster platform for running big-data frameworks such as Apache Hadoop and Apache Spark; an EMR cluster is a collection of Amazon EC2 instances. Starting with EMR release 4.8.0, security configurations can specify data-at-rest and data-in-transit encryption for the cluster.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md
index d81c032dd5..5cd48efd65 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md
@@ -1,5 +1,7 @@
 # AWS - IAM, Identity Center & SSO Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## IAM
 
 You can find a **description of IAM** in:
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md
index 6fd6e75032..81ebcd1ee9 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md
@@ -1,5 +1,7 @@
 # AWS - Amazon Data Firehose Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Amazon Data Firehose
 
 Amazon Data Firehose, formerly named Amazon Kinesis Data Firehose, is a **fully managed service** that facilitates the delivery of **real-time streaming data**. It supports a variety of destinations, including Amazon Simple Storage Service (Amazon S3), Amazon Redshift, Amazon OpenSearch Service, Splunk, and custom HTTP endpoints.<sup>[[1]](#references)[[8]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md
index f819503e79..55f16e587d 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md
@@ -1,5 +1,7 @@
 # AWS - KMS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## KMS - Key Management Service
 
 AWS Key Management Service (AWS KMS) is a managed service for creating and controlling cryptographic keys used to encrypt and sign data. AWS KMS performs cryptographic operations through a distributed fleet of FIPS 140-3 validated hardware security modules (HSMs).<sup>[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md
index 7e58b31542..b6f6dd6928 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Lambda
 
 Amazon Web Services (AWS) Lambda is a serverless compute service that runs code in response to events without requiring you to provision or manage servers. Lambda manages the execution environments and resources needed to run functions, including capacity provisioning and automatic scaling on high-availability infrastructure. Security and access are controlled through Lambda permissions, execution roles, and resource-based policies. Lambda function pricing is based on requests and execution duration (measured in GB-seconds), rather than solely on compute time.<sup>[[3]](#references)[[4]](#references)[[19]](#references)</sup>
@@ -206,4 +208,3 @@ In the following page you can check how to **abuse Lambda permissions to escalat
 - [21] [Lambda layers — Getting started concepts](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-concepts.html#gettingstarted-concepts-layer)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md
index c3ba81c7df..f2b366327a 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md
@@ -1,5 +1,7 @@
 # AWS - Lightsail Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## AWS - Lightsail
 
 Amazon Lightsail is an easy, lightweight way for new cloud users to deploy websites and web applications using **virtual private servers** and **container services**, while also providing managed databases, load balancers, storage, static IP addresses, DNS management, and snapshots.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-macie-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-macie-enum.md
index c3a8d63dcf..93b5332126 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-macie-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-macie-enum.md
@@ -1,5 +1,7 @@
 # Amazon Macie
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Macie
 
 Amazon Macie is an AWS service for automating the discovery, logging, and reporting of sensitive data in Amazon S3. It supports automated sensitive data discovery and targeted sensitive data discovery jobs, and it produces sensitive data findings and sensitive data discovery results for the objects it analyzes.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md
index b56c1904f2..e4d2dcba88 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md
@@ -1,5 +1,7 @@
 # AWS - MQ Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Amazon MQ
 
 ### Introduction to Message Brokers
@@ -83,4 +85,3 @@ If you know credentials for a RabbitMQ administrator account, you can create a n
 - [9] [Simple authentication and authorization - Amazon MQ](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/rabbitmq-simple-auth-broker-users.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md
index d6b04f9011..198fc2234c 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md
@@ -1,5 +1,7 @@
 # AWS - MSK Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Amazon MSK
 
 **Amazon Managed Streaming for Apache Kafka (Amazon MSK)** is a service that is fully managed, facilitating the development and execution of applications processing streaming data through **Apache Kafka**. Control-plane operations, including creation, update, and deletion of **clusters**, are offered by Amazon MSK. The service permits the utilization of Apache Kafka **data-plane operations**, encompassing data production and consumption. It operates on **open-source versions of Apache Kafka**, ensuring compatibility with existing applications, tooling, and plugins from both partners and the **Apache Kafka community**, eliminating the need for alterations in the application code.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md
index 5b514e52be..969342c7c8 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md
@@ -1,5 +1,7 @@
 # AWS - Organizations Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 AWS Organizations enables centralized management and governance across AWS accounts, including resource allocation, account grouping, governance policies, and simplified billing. The Organizations service itself is offered at no additional charge, while resources used by member accounts remain billable.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
@@ -56,4 +58,3 @@ The Organizations list operations are paginated; when enumerating results, conti
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md
index 0c7623049b..e9e91bf4db 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md
@@ -1,5 +1,7 @@
 # AWS - Other Services Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Directconnect
 
 Direct Connect establishes a dedicated network connection between an on-premises/corporate network and AWS.<sup>[[1]](#references)</sup> During an assessment, check whether a compromised EC2 instance can reach the corporate network across that connection.
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md
index f06fb0e0ce..09b2adbce6 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md
@@ -1,5 +1,7 @@
 # AWS - Redshift Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Amazon Redshift
 
 Amazon Redshift is a fully managed, petabyte-scale data warehouse service in the cloud. Redshift clusters let you run analytics on datasets using SQL-based tools and business intelligence applications.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md
index 29ea634ac4..f928846664 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md
@@ -1,5 +1,7 @@
 # AWS - Relational Database (RDS) Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 The **Relational Database Service (RDS)** offered by AWS is designed to streamline the deployment, operation, and scaling of a **relational database in the cloud**. This service offers the advantages of cost efficiency and scalability while automating labor-intensive tasks like hardware provisioning, database configuration, patching, and backups.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md
index 8276bcc0cc..1eeb08c693 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md
@@ -1,5 +1,7 @@
 # AWS - Route53 Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Route 53
 
 Amazon Route 53 is a cloud **Domain Name System (DNS)** web service.\
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md
index f025807a5e..9c0226eb61 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md
@@ -1,5 +1,7 @@
 # AWS - S3, Athena & Glacier Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## S3
 
 Amazon S3 is an object-storage service that lets you store and retrieve large amounts of data.<sup>[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sagemaker-enum/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-sagemaker-enum/README.md
index 0ecef7aeae..7cc16139a5 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-sagemaker-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-sagemaker-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - SageMaker Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Service Overview
 
 Amazon SageMaker is AWS' managed machine-learning platform that brings together notebooks, data preparation, training infrastructure, orchestration, registries, model deployment, and managed endpoints.<sup>[[1]](#references)</sup> A compromise of SageMaker resources typically provides:
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md
index de3e1edb12..26d2fb3944 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md
@@ -1,5 +1,7 @@
 # AWS - Secrets Manager Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## AWS Secrets Manager
 
 AWS Secrets Manager is designed to **eliminate the use of hard-coded secrets in applications by replacing them with an API call**. This service serves as a **centralized repository for all your secrets**, ensuring they are managed uniformly across all applications.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md
index ca03a2448f..d8af16aecd 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md
@@ -1,6 +1,7 @@
 # AWS - Security & Detection Services
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md
index ecf961c79c..5f121f2645 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md
@@ -1,5 +1,7 @@
 # AWS - CloudTrail Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## **CloudTrail**
 
 AWS CloudTrail **records and monitors activity within your AWS environment**. It captures detailed **event logs**, including who did what, when, and from where, for interactions with AWS resources. This provides an audit trail of changes and actions, aiding in security analysis, compliance auditing, and resource change tracking. CloudTrail is essential for understanding user and resource behavior, improving security posture, and supporting regulatory compliance.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md
index 0b443cade2..b4d58ffc4b 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md
@@ -1,5 +1,7 @@
 # AWS - CloudWatch Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## CloudWatch
 
 **CloudWatch** **collects** monitoring and operational **data** in the form of logs/metrics/events, providing a **unified view of AWS resources**, applications, and services. It can set **high-resolution alarms**, visualize **logs** and **metrics** side by side, take automated actions, troubleshoot issues, and discover insights to optimize applications.<sup>[[1]](#references)[[4]](#references)</sup>
@@ -493,4 +495,3 @@ aws cloudwatch untag-resource --resource-arn <value> --tag-keys <value>
 - [31] [Actions, resources, and condition keys for Amazon CloudWatch - legacy URL](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md
index 8d47d40569..c787d6e9f9 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md
@@ -1,5 +1,7 @@
 # AWS - Config Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS Config
 
 AWS Config records configuration changes for supported resource types in scope as configuration items (CIs). A customer-managed configuration recorder is scoped to an AWS account and Region; by default, it records supported resources in the Region where AWS Config is running, subject to resource coverage and recording settings.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md
index 2334b38790..363218b429 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md
@@ -1,5 +1,7 @@
 # AWS - Control Tower Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Control Tower
 
 > [!NOTE]
@@ -50,4 +52,3 @@ aws controltower list-enabled-controls --target-identifier arn:aws:organizations
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md
index 91c164ee2c..4e2a113f2b 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md
@@ -1,5 +1,7 @@
 # AWS - Cost Explorer Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Cost Explorer and Anomaly detection
 
 This allows you to check **how money is being spent across AWS services** and helps with **detecting anomalies**.<sup>[[1]](#references)[[2]](#references)</sup>\
@@ -19,4 +21,3 @@ They can also monitor service usage rather than currency, such as selected stora
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md
index 9db4a274f1..ef4d161bc7 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md
@@ -1,5 +1,7 @@
 # AWS - Detective Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Detective
 
 **Amazon Detective** streamlines the security investigation process, making it more efficient to **analyze, investigate, and pinpoint the root cause** of security issues or unusual activities. It automates the collection of log data from AWS resources and employs **machine learning, statistical analysis, and graph theory** to construct an interconnected data set. This setup greatly enhances the speed and effectiveness of security investigations.<sup>[[1]](#references)[[3]](#references)</sup>
@@ -15,4 +17,3 @@ The service eases in-depth exploration of security incidents, allowing security
 - [5] [Amazon Detective - CloudSecDocs (archived)](https://web.archive.org/web/20211123225615/https://cloudsecdocs.com/aws/services/logging/other/#detective)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md
index 4a2141e428..6c0210d3cb 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md
@@ -1,5 +1,7 @@
 # AWS - Firewall Manager Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Firewall Manager
 
 **AWS Firewall Manager** streamlines the management and maintenance of **AWS WAF, AWS Shield Advanced, Amazon VPC security groups and Network Access Control Lists (ACLs), and AWS Network Firewall, AWS Route 53 Resolver DNS Firewall and third-party firewalls** across multiple accounts and resources. It enables you to configure your firewall rules, Shield Advanced protections, VPC security groups, and Network Firewall settings just once, with the service **automatically enforcing these rules and protections across your accounts and resources**, including newly added ones.<sup>[[1]](#references)[[3]](#references)[[4]](#references)[[5]](#references)</sup>
@@ -345,4 +347,3 @@ aws fms untag-resource --resource-arn <value> --tag-keys <value>
 - [31] [Actions, resources, and condition keys for AWS Firewall Manager - legacy URL](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md
index a317e3177c..efa8fb7a60 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md
@@ -1,5 +1,7 @@
 # AWS - GuardDuty Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## GuardDuty
 
 According to the [**docs**](https://aws.amazon.com/guardduty/features/), GuardDuty combines **machine learning, anomaly detection, network monitoring, and malicious file discovery**, using both AWS and industry-leading third-party sources to help protect workloads and data on AWS. GuardDuty can analyze tens of billions of events across multiple AWS data sources, such as AWS CloudTrail event logs, Amazon Virtual Private Cloud (VPC) Flow Logs, Amazon Elastic Kubernetes Service (EKS) audit and system-level logs, and DNS query logs.<sup>[[9]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md
index 1a83f7f1b6..335a43b99c 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md
@@ -1,5 +1,7 @@
 # AWS - Inspector Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Inspector
 
 Amazon Inspector is a vulnerability management service that automatically discovers workloads and continually scans Amazon EC2 instances, container images in Amazon ECR, and AWS Lambda functions for software vulnerabilities and unintended network exposure. It can also map ECR images to running Amazon ECS containers. Inspector creates findings with severity ratings, affected-resource details, and remediation information.<sup>[[1]](#references)[[3]](#references)[[11]](#references)</sup>
@@ -402,4 +404,3 @@ aws inspector2 untag-resource --resource-arn <value> --tag-keys <value>
 - [21] [Actions, resources, and condition keys for Amazon Inspector2 - legacy URL](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector2.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md
index 54a8ab194c..31f55b1031 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md
@@ -1,5 +1,7 @@
 # AWS - Security Hub Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Security Hub
 
 **Security Hub** collects security **data** from **across AWS accounts**, services, and supported third-party partner products and helps you **analyze your security** trends and identify the highest priority security issues.<sup>[[1]](#references)</sup>
@@ -75,4 +77,3 @@ TODO, PRs accepted
 - [9] [AWS Security Hub - CloudSecDocs (archived)](https://web.archive.org/web/20211123225615/https://cloudsecdocs.com/aws/services/logging/other/#security-hub)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md
index 97ad6ff975..0665679434 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md
@@ -1,5 +1,7 @@
 # AWS - Shield Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Shield
 
 AWS Shield is a managed DDoS protection service that helps protect AWS applications and infrastructure against distributed denial-of-service (DDoS) attacks.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md
index 22584c2b63..bcb877960b 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md
@@ -1,5 +1,7 @@
 # AWS - Trusted Advisor Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS Trusted Advisor Overview
 
 Trusted Advisor inspects your AWS environment and provides recommendations based on AWS best practices to help save money, improve availability and performance, and close security gaps.<sup>[[1]](#references)[[6]](#references)</sup> Trusted Advisor organizes its checks into six categories: cost optimization, performance, security, fault tolerance, service limits, and operational excellence.<sup>[[2]](#references)</sup> Trusted Advisor can report findings for resources in multiple AWS Regions, with the affected Region included in many check reports.<sup>[[4]](#references)</sup>
@@ -76,4 +78,3 @@ AWS Trusted Advisor is therefore useful for enumerating account-level recommenda
 - [6] [AWS Trusted Advisor - CloudSecDocs (archived)](https://web.archive.org/web/20211123225615/https://cloudsecdocs.com/aws/services/logging/other/#trusted-advisor)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md
index bc51573c2f..d19c3cd1e3 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md
@@ -1,5 +1,7 @@
 # AWS - WAF Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS WAF
 
 AWS WAF is a **web application firewall** that monitors HTTP and HTTPS requests forwarded to protected resources and lets you control access with rules that can address common threats such as SQL injection and cross-site scripting.<sup>[[2]](#references)[[18]](#references)</sup>
@@ -482,4 +484,3 @@ aws wafv2 untag-resource --resource-arn <value> --tag-keys <value>
 - [19] [Actions, resources, and condition keys for AWS WAF V2 - legacy URL](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md
index 2de97ce948..a2f87daedf 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md
@@ -1,5 +1,7 @@
 # AWS - SES Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Amazon Simple Email Service (Amazon SES) is an email platform for **sending and receiving emails**. It supports transactional, marketing, and other correspondence, and it **integrates with other AWS services** for email-related workflows.<sup>[[1]](#references)</sup>
@@ -139,4 +141,3 @@ aws ses get-send-statistics
 - [13] [get-dedicated-ips — AWS CLI](https://docs.aws.amazon.com/cli/latest/reference/sesv2/get-dedicated-ips.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md
index 7755c66a6c..2c60e9a6c6 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md
@@ -1,5 +1,7 @@
 # AWS - SNS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## SNS
 
 Amazon Simple Notification Service (Amazon SNS) is a **fully managed messaging service** that supports both **application-to-application** (A2A) and **application-to-person** (A2P) communication types.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md
index 5a727933f0..9ec2802ea7 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md
@@ -1,5 +1,7 @@
 # AWS - SQS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## SQS
 
 Amazon Simple Queue Service (SQS) is a **fully managed message queuing service**. Its main function is to assist in the scaling and decoupling of microservices, distributed systems, and serverless applications. The service is designed to remove the need for managing and operating message-oriented middleware, which can often be complex and resource-intensive. This elimination of complexity allows developers to direct their efforts towards more innovative and differentiating aspects of their work.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md
index 1dd24840af..57274f32dc 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md
@@ -1,5 +1,7 @@
 # AWS - Step Functions Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Step Functions
 
 AWS Step Functions is a workflow service that enables you to coordinate and orchestrate multiple AWS services into serverless workflows. By using AWS Step Functions, you can design and run workflows that connect various AWS services such as AWS Lambda, Amazon S3, Amazon DynamoDB, and many more, in a sequence of steps. This orchestration service provides a visual workflow interface and offers **state machine** capabilities, allowing you to define each step of the workflow in a declarative manner using JSON-based **Amazon States Language** (ASL).<sup>[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md
index 8b768519ad..cb017800af 100644
--- a/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md
@@ -1,5 +1,7 @@
 # AWS - STS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## STS
 
 **AWS Security Token Service (STS)** is primarily designed to issue **temporary, limited-privilege credentials**. These credentials can be requested for **AWS Identity and Access Management (IAM)** users or for authenticated users (federated users).<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md b/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md
index 9e035ffb23..903ada9a46 100644
--- a/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md
+++ b/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md
@@ -1,5 +1,7 @@
 # AWS - EventBridge Scheduler Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## EventBridge Scheduler
 
 **Amazon EventBridge Scheduler** is a fully managed, **serverless scheduler designed to create, run, and manage tasks** at scale. It enables you to schedule millions of tasks across over 270 AWS services and 6,000+ API operations, all from a central service. With built-in reliability and no infrastructure to manage, EventBridge Scheduler simplifies scheduling, reduces maintenance costs, and scales automatically to meet demand. You can configure cron or rate expressions for recurring schedules, set one-time invocations, and define flexible delivery windows with retry options, ensuring tasks are reliably delivered based on the availability of downstream targets.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md
index 0ddbb916e7..50b59292d0 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md
@@ -1,5 +1,7 @@
 # AWS - Unauthenticated Enum & Access
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## AWS Credentials Leaks
 
 A common way to obtain access or information about an AWS account is by **searching for leaks**. You can search for leaks using **google dorks**, checking the **public repos** of the **organization** and the **workers** of the organization in **Github** or other platforms, searching in **credentials leaks databases**... or in any other part you think you might find any information about the company and its cloud infa.\
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum/README.md
index 829f5a785f..ec4b15963f 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Accounts Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Account IDs
 
 An AWS account ID is a 12-digit identifier, and an account alias can be used in the IAM user sign-in URL in its place. During an authorized assessment, these public identifiers can help build a list of accounts related to a target.<sup>[[2]](#references)</sup>
@@ -47,4 +49,3 @@ Inspect error responses from probes for account-scoped ARNs. AWS documents that
 - [8] [Troubleshoot access denied error messages](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum/README.md
index 4aa37d7990..e72624822a 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - API Gateway Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### API Invoke bypass
 
 A Lambda authorizer returns an IAM policy that API Gateway evaluates before invoking the method. The policy uses the `execute-api:Invoke` action and an execution ARN in this form.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum/README.md
index 99c90a9581..94f2e99c61 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Cloudfront Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 CloudFront automatically assigns a distribution domain name such as `d111111abcdef8.cloudfront.net`, which can be used in object URLs.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access/README.md
index 152bce1851..1709778715 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access/README.md
@@ -1,5 +1,7 @@
 # AWS - CodeBuild Unauthenticated Access
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## CodeBuild
 
 For more info check this page:
@@ -39,4 +41,3 @@ This new relationship between Github Actions and AWS creates another way to comp
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum/README.md
index ff6028a483..47d6fdac0e 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Cognito Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Unauthenticated Cognito
 
 Cognito is an AWS service that enables developers to **grant their app users access to AWS services**. Developers can grant **IAM roles to authenticated users** in their app (potentially people will be able to just sign up) and can also grant an **IAM role to unauthenticated users**.<sup>[[1]](#references)</sup>
@@ -56,4 +58,3 @@ Pacu (new:test) > run cognito__enum
 - [9] [Attacking AWS Cognito with Pacu (p2)](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum/README.md
index 661724a3ef..984b520f37 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - DocumentDB Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 Amazon DocumentDB cluster endpoints use the DNS form shown below; AWS documents an example such as `sample-cluster.cluster-123456789012.us-east-1.docdb.amazonaws.com`.<sup>[[1]](#references)</sup>
@@ -18,4 +20,3 @@ The hostname is not itself an unauthenticated public access path: Amazon Documen
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access/README.md
index abc76c66cc..b53bb3a908 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access/README.md
@@ -1,5 +1,7 @@
 # AWS - DynamoDB Unauthenticated Access
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Dynamo DB
 
 DynamoDB's low-level API requires every HTTP(S) request to carry a valid digital signature, so an arbitrary anonymous request cannot directly call the service.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum/README.md
index a1f9a80970..68690efb04 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - EC2 Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## EC2 & Related Services
 
 Check in this page more information about this:
@@ -72,4 +74,3 @@ aws ec2 describe-instances --query "Reservations[].Instances[?PublicIpAddress!=n
 - [7] [Internet-facing Classic Load Balancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-internet-facing-load-balancers.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum/README.md
index 12fc527e36..00d6153730 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - ECR Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECR
 
 For more information check:
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum/README.md
index 8bf0ecbe99..4df284d19e 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - ECS Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## ECS
 
 For more information check:
@@ -32,4 +34,3 @@ aws elbv2 describe-load-balancers --query 'LoadBalancers[?Scheme == `internet-fa
 - [4] [describe-load-balancers - AWS CLI Command Reference](https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-load-balancers.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum/README.md
index 21414997b4..e35cc4f3d0 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Elastic Beanstalk Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Elastic Beanstalk
 
 For more information check:
@@ -47,4 +49,3 @@ aws elasticbeanstalk describe-environments --query 'Environments[?Status==`Ready
 - [9] [DescribeEnvironments - AWS Elastic Beanstalk API Reference](https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironments.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum/README.md
index 1be7027836..d4a6f818b1 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Elasticsearch Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 AWS documents `search-...` as the public endpoint form and `vpc-...` as the VPC endpoint form for Amazon OpenSearch Service domains. Public endpoints are reachable from internet-connected devices, while VPC endpoints require connectivity to the VPC.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum/README.md
index 02db68809b..86a0588843 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - IAM & STS Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Enumerate Roles & Usernames in an account
 
 ### ~~Assume Role Brute-Force~~
@@ -187,4 +189,3 @@ Because `StringLike` treats `*` as a wildcard, `repo:org_name*:*` also matches n
 - [14] [OpenID Connect reference](https://docs.github.com/en/actions/reference/security/oidc)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum/README.md
index cc8ef63b45..32f323d7b4 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Identity Center & SSO Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## AWS Device Code Phishing
 
 Initially proposed in [**this blog post**](https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/), it's possible to send a **link** to a user using AWS SSO that if the **user accepts** the attacker will be able to get a **token to impersonate the user** and access all the roles the user is able to access in the **Identity Center**.<sup>[[1]](#references)</sup>
@@ -139,4 +141,3 @@ For more info about this [**check this post**](https://mjg59.dreamwidth.org/6217
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum/README.md
index 84f3a6bc1c..d852b0d50f 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - IoT Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 The `{random_id}` placeholder is an account-specific AWS IoT Core device-data endpoint, not an arbitrary value. Retrieve the endpoint with `aws iot describe-endpoint --endpoint-type iot:Data-ATS` instead of guessing it.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum/README.md
index 03b66816ca..051ef4b84e 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Kinesis Video Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 AWS's HLS playback documentation shows a stream-specific data endpoint in the following form. The hostname alone is not a media URL: the endpoint is obtained for a named stream, and playback uses a separate HLS session URL containing a token.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access/README.md
index 1bedfab248..4955c64074 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access/README.md
@@ -1,5 +1,7 @@
 # AWS - Lambda Unauthenticated Access
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Public Function URL
 
 A Lambda function can be configured with a **public function URL** that anyone can access when its `AuthType` is `NONE` and its resource-based policy grants public access.<sup>[[1]](#references)</sup> Such a handler should be reviewed like any public web endpoint.
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum/README.md
index e3309571b4..a002515128 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Media Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 AWS Elemental MediaConvert account-specific endpoints and AWS Elemental MediaPackage V1 channel input URLs use the following patterns:<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum/README.md
index 3df83adef4..d74dfd0c99 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - MQ Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Public Port
 
 Public accessibility is a broker setting: it enables connections from applications outside the VPC that hosts the broker's subnets, but Amazon MQ sets it to `false` by default when the value is omitted.<sup>[[1]](#references)</sup>
@@ -29,4 +31,3 @@ ssl://b-{uuid}-{1,2}.mq.{region}.amazonaws.com:61617
 - [4] [Authentication and authorization for Amazon MQ brokers - Amazon MQ](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-access.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum/README.md
index b868e0e42a..acd8bb46ba 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - MSK Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public Port
 
 It's possible to **expose the Kafka broker to the public**, but you will need **credentials**, IAM permissions, or a valid client certificate, depending on the authentication method configured.<sup>[[1]](#references)[[3]](#references)[[4]](#references)[[5]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum/README.md
index bafc3e766e..578a8f9675 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - RDS Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## RDS
 
 For more information check:
@@ -68,4 +70,3 @@ postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432
 - [8] [Finding the connection information for an Amazon RDS DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_CommonTasks.Connect.EndpointAndPort.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum/README.md
index b9d01b4df6..88efd98053 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - Redshift Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ### Public URL template
 
 Amazon Redshift provides the cluster-specific endpoint in the cluster details or from a `DescribeClusters` request; use that endpoint instead of guessing the hostname.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum/README.md
index 2c88882067..29ad9ea356 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - S3 Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## S3 Public Buckets
 
 A bucket or object is **public** when its effective policy or ACL grants access to the general public. Anonymous `s3:ListBucket` access exposes object keys, while public `s3:GetObject` access can expose individual objects even when bucket listing is denied.<sup>[[3]](#references)</sup>
@@ -202,4 +204,3 @@ Amazon S3 discontinued support for Email Grantee ACLs on October 1, 2025; reques
 - [22] [FLAWS2.cloud](http://flaws2.cloud/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sagemaker-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sagemaker-unauthenticated-enum/README.md
index 163a6953fe..a5008fa063 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sagemaker-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sagemaker-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - SageMaker Unauthorized Access
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Presigned URLs for SageMaker
 
 If an attacker obtains a presigned URL from SageMaker's `CreatePresignedNotebookInstanceUrl` API, they can connect to the associated notebook instance's Jupyter server without any additional permission. The IAM user or role that calls the API defines permission to access the notebook instance; the URL must be opened within five minutes, and its session lasts 12 hours by default.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum/README.md
index 6566b67088..9a9c57ebb2 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - SNS Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SNS
 
 For more information about SNS check:
diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum/README.md
index 5a5a0d640b..507dd796fa 100644
--- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # AWS - SQS Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## SQS
 
 For more information about SQS check:
@@ -28,4 +30,3 @@ An SQS queue policy can be misconfigured to grant anonymous users `ReceiveMessag
 {{#include ../../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/azure-security/README.md b/src/pentesting-cloud/azure-security/README.md
index 91e37f3ad9..61b5c8bd16 100644
--- a/src/pentesting-cloud/azure-security/README.md
+++ b/src/pentesting-cloud/azure-security/README.md
@@ -1,5 +1,7 @@
 # Azure Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Learn the basics of Azure and Entra ID in the following page:
diff --git a/src/pentesting-cloud/azure-security/az-basic-information/README.md b/src/pentesting-cloud/azure-security/az-basic-information/README.md
index 7b7d776ce6..5b3c9faee1 100644
--- a/src/pentesting-cloud/azure-security/az-basic-information/README.md
+++ b/src/pentesting-cloud/azure-security/az-basic-information/README.md
@@ -1,5 +1,7 @@
 # Az - Basic Information
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Organization Hierarchy
 
 <figure><img src="https://lh7-rt.googleusercontent.com/slidesz/AGV_vUcVrh1BpuQXN7RzGqoxrn-4Nm_sjdJU-dDTvshloB7UMQnN1mtH9N94zNiPCzOYAqE9EsJqlboZOj47tQsQktjxszpKvIDPZLs9rgyiObcZCvl7N0ZWztshR0ZddyBYZIAwPIkrEQ=s2048?key=l3Eei079oPmVJuh8lxQYxxrB" alt=""><figcaption><p><a href="https://www.tunecom.be/stg_ba12f/wp-content/uploads/2020/01/VDC-Governance-ManagementGroups-1536x716.png">https://www.tunecom.be/stg_ba12f/wp-content/uploads/2020/01/VDC-Governance-ManagementGroups-1536x716.png</a></p></figcaption></figure>
@@ -424,4 +426,3 @@ You **cannot** explicitly **deny** **access** to specific resources **using cond
 - [43] [Manage the Stay signed in prompt](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-stay-signed-in-prompt)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-basic-information/az-federation-abuse.md b/src/pentesting-cloud/azure-security/az-basic-information/az-federation-abuse.md
index 75d5dedd75..6017c1c13a 100644
--- a/src/pentesting-cloud/azure-security/az-basic-information/az-federation-abuse.md
+++ b/src/pentesting-cloud/azure-security/az-basic-information/az-federation-abuse.md
@@ -1,5 +1,7 @@
 # Azure – Federation Abuse (GitHub Actions OIDC / Workload Identity)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Overview
 
 GitHub Actions can federate to Azure Entra ID (formerly Azure AD) using OpenID Connect (OIDC). A GitHub workflow requests a short‑lived GitHub ID token (JWT) that encodes details about the run. Azure validates this token against a Federated Identity Credential (FIC) on an App Registration (service principal) and exchanges it for Azure access tokens (MSAL cache, bearer tokens for Azure APIs).<sup>[[1]](#references)[[6]](#references)[[7]](#references)[[8]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md b/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md
index 4861aac155..a7890f2b75 100644
--- a/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md
+++ b/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md
@@ -1,5 +1,7 @@
 # Az - Tokens & Public Applications
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Entra ID is Microsoft's cloud-based identity and access management (IAM) platform, serving as the foundational authentication and authorization system for services like Microsoft 365 and Azure Resource Manager. Azure AD implements the OAuth 2.0 authorization framework and the OpenID Connect (OIDC) authentication protocol to manage access to resources.<sup>[[1]](#references)[[32]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-device-registration.md b/src/pentesting-cloud/azure-security/az-device-registration.md
index 0e9928c6f7..cd28d7136c 100644
--- a/src/pentesting-cloud/azure-security/az-device-registration.md
+++ b/src/pentesting-cloud/azure-security/az-device-registration.md
@@ -1,5 +1,7 @@
 # Az - Device Registration
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 When a Windows device joins Microsoft Entra ID, the Device Registration Service (DRS) creates a device object in the tenant. During a managed join, the user authenticates, the client discovers the DRS endpoints, and any configured MDM terms are handled before registration. The client then creates two preferably TPM-bound RSA key pairs: the device key (`dkpub`/`dkpriv`) and the transport key (`tkpub`/`tkpriv`). It sends the ID token, certificate request, public transport key, and attestation data to DRS; DRS returns a device ID and a signed device certificate. MDM enrollment is a subsequent step, so an Entra device object does not by itself prove Intune enrollment.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-enumeration-tools.md b/src/pentesting-cloud/azure-security/az-enumeration-tools.md
index e1f2decb52..a88b60e0de 100644
--- a/src/pentesting-cloud/azure-security/az-enumeration-tools.md
+++ b/src/pentesting-cloud/azure-security/az-enumeration-tools.md
@@ -1,5 +1,7 @@
 # Az - Enumeration Tools
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Install PowerShell in Linux
 
 > [!TIP]
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md
index dc1e909f01..b3d63afe2c 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/README.md
@@ -1,5 +1,7 @@
 # Az - Lateral Movement (Cloud - On-Prem)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 This section covers the pivoting techniques to move from a compromised Entra ID tenant into the on-premises Active Directory (AD) or from a compromised AD to the Entra ID tenant.
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md
index 1d3d2c096d..a4ff12647d 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md
@@ -1,5 +1,7 @@
 # Az - Arc vulnerable GPO Deploy Script
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ### Identifying the Issues
 
 Azure Arc allows for the integration of new internal servers (joined domain servers) into Azure Arc using the Group Policy Object method.<sup>[[2]](#references)</sup> To facilitate this, Microsoft provides a deployment toolkit necessary for initiating the onboarding procedure. Inside the ArcEnableServerGroupPolicy.zip file, the following scripts can be found: DeployGPO.ps1, EnableAzureArc.ps1, and AzureArcDeployment.psm1.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md
index bc48231fd4..88aef0474a 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-kerberos-trust.md
@@ -1,5 +1,7 @@
 # Az - Cloud Kerberos Trust
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **This post is a summary of** [**https://dirkjanm.io/obtaining-domain-admin-from-azure-ad-via-cloud-kerberos-trust/**](https://dirkjanm.io/obtaining-domain-admin-from-azure-ad-via-cloud-kerberos-trust/) **which can be checked for further information about the attack. This technique is also commented in** [**https://www.youtube.com/watch?v=AFay_58QubY**](https://www.youtube.com/watch?v=AFay_58QubY)**.**<sup>[[1]](#references)[[2]](#references)</sup>
 
 ## Kerberos Trust Relationship Overview
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md
index c896bc920a..6e78bae341 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-cloud-sync.md
@@ -1,5 +1,7 @@
 # Az - Cloud Sync
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Cloud Sync** is basically the new way of Azure to **synchronize the users from AD into Entra ID**.
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md
index 0e51fd8b80..bcdab05368 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-connect-sync.md
@@ -1,5 +1,7 @@
 # Az - Connect Sync
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 [From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-whatis) Microsoft Entra Connect synchronization services (Microsoft Entra Connect Sync) is a main component of Microsoft Entra Connect. It takes care of all the operations that are related to synchronize identity data between your on-premises environment and Microsoft Entra ID.<sup>[[7]](#references)</sup>
@@ -235,4 +237,3 @@ az-seamless-sso.md
 - [21] [TR19: I'm in your cloud, reading everyone's emails - hacking Azure AD via Active Directory](https://www.youtube.com/watch?v=JEIR5oGCwdg)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md
index e1b2931366..2b8e08b599 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-domain-services.md
@@ -1,5 +1,7 @@
 # Az - Microsoft Entra Domain Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Domain Services
 
 Microsoft Entra Domain Services lets you deploy an Active Directory-compatible managed domain in Azure without managing or receiving administrative access to its domain controllers.<sup>[[1]](#references)[[7]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-exchange-hybrid-impersonation.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-exchange-hybrid-impersonation.md
index 083ed6c1e7..62f5f6ac7c 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-exchange-hybrid-impersonation.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-exchange-hybrid-impersonation.md
@@ -1,5 +1,7 @@
 # Az - Exchange Hybrid Impersonation (ACS Actor Tokens)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 In legacy Exchange Hybrid designs, the on-prem Exchange deployment could authenticate as the same Entra application identity used by Exchange Online. If an attacker compromised the Exchange server, extracted the hybrid certificate private key, and performed an OAuth client-credentials flow, they could obtain first-party tokens with Exchange Online privilege context.<sup>[[1]](#references)[[2]](#references)[[5]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md
index 754468ba97..dd33a56287 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-federation.md
@@ -1,5 +1,7 @@
 # Az - Federation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Federation links domains that trust one another for authentication and authorization. Microsoft Entra ID can federate an on-premises environment with AD FS or another supported provider, handing sign-in to that trusted system so users can use their on-premises identities with cloud applications.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md
index 9f89d752fa..7423058afb 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-hybrid-identity-misc-attacks.md
@@ -1,5 +1,7 @@
 # Hybrid Identity Miscellaneous Attacks
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Matching an on-premises account to an existing cloud user
 
 Microsoft Entra Connect synchronizes user objects from on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. A new on-premises object can be matched to an existing cloud-managed user by a **soft match** on `userPrincipalName` or the primary `proxyAddresses` value (the `SMTP:` entry), or by a **hard match** on the source anchor and its corresponding `immutableID`; after a match, the cloud object becomes on-premises managed.<sup>[[4]](#references)[[5]](#references)</sup>
@@ -28,4 +30,3 @@ To assess this historical technique, the relevant requirements are:
 - [7] [Microsoft Entra Connect: Troubleshoot errors during synchronization](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-sync-errors)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md
index 1f61b04eb6..82140330fe 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md
@@ -1,5 +1,7 @@
 # Az - Local Cloud Credentials
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Local Token Storage and Security Considerations
 
 ### Azure CLI (Command-Line Interface)
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md
index d2e71ed0ed..589f4419f3 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md
@@ -1,5 +1,7 @@
 # Az - Pass the Certificate
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Pass the Certificate (Azure)
 
 Microsoft Entra joined machines can use Entra-issued `MS-Organization-P2P-Access` certificates to establish trust with other joined machines in the same tenant for remote desktop scenarios. The original Pass the Certificate research describes this peer-to-peer flow as using the **NegoEx** authentication mechanism and a certificate issued for the required user.<sup>[[1]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md
index 18f978e8de..30214edd26 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md
@@ -1,5 +1,7 @@
 # Az - Pass the Cookie
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Why Cookies?
 
 Browser **cookies** can carry an already-authenticated web session. If an attacker obtains and replays a valid session cookie issued after the user completed MFA, the service may accept it without another interactive authentication step; this is the basis of pass-the-cookie session hijacking.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md
index bda97d253b..55a89a3666 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md
@@ -1,5 +1,7 @@
 # Az - Primary Refresh Token (PRT)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## What is a Primary Refresh Token (PRT)?
 
 A **Primary Refresh Token (PRT)** is a long-lived refresh token used in Microsoft Entra ID (formerly Azure AD) authentication, analogous to a Kerberos TGT. It is issued during authentication on a Microsoft Entra joined, hybrid joined, or registered device and can be used to request access tokens for applications without repeatedly prompting for credentials. Each PRT is accompanied by a **session key** (also called a Proof-of-Possession key) that signs requests and proves possession of the PRT. The PRT itself is an opaque blob that client components cannot read, while the session key signs a JWT containing the PRT when requesting tokens. Possessing the PRT alone is therefore insufficient, similar to needing both a Kerberos TGT and its session key for authentication.<sup>[[1]](#references)[[7]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md
index 1b192b0a7a..8c73d11641 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md
@@ -1,5 +1,7 @@
 # Az - PTA - Pass-through Authentication
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Microsoft Entra pass-through authentication (PTA) lets users sign in to on-premises and cloud applications with the same password, while Microsoft Entra ID validates that password against the on-premises Active Directory. Using one password can also reduce password-related helpdesk friction.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md
index 252f00809d..5d64924d75 100644
--- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md
+++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md
@@ -1,5 +1,7 @@
 # Az - Seamless SSO
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 [Microsoft Entra seamless single sign-on (Seamless SSO)](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso) automatically signs users in from corporate, domain-connected devices on the corporate network, without requiring another on-premises component. Depending on the application and tenant hints, users may not need to enter either their username or password.<sup>[[1]](#references)</sup>
@@ -226,4 +228,3 @@ If the Active Directory administrators have access to Azure AD Connect, they can
 - [20] [Security identifiers](https://learn.microsoft.com/en-us/windows/win32/secauthz/security-identifiers)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md b/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md
index 394f262214..01c47851b3 100644
--- a/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md
+++ b/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md
@@ -1,5 +1,7 @@
 # Az - Permissions for a Pentest
 
+{{#include ../../banners/hacktricks-training.md}}
+
 To start a white-box hardening review of some Entra ID tenants, you need to ask for the **`Global Reader` role on each tenant**. Microsoft documents Global Reader as a read-only role with the Global Administrator's visibility but without update capability.<sup>[[1]](#references)</sup> Moreover, to perform a hardening review of different Azure subscriptions, you would need at least the **`Reader` role over all the subscriptions**. Reader grants `*/read` for control-plane information and no data actions.<sup>[[2]](#references)</sup>
 
 Note that if those roles aren't enough to access all the info you need, you could also ask the client for roles with the permissions you need. Just try to **minimize the amount of non-read-only permissions you ask for!**
diff --git a/src/pentesting-cloud/azure-security/az-persistence/README.md b/src/pentesting-cloud/azure-security/az-persistence/README.md
index 937e91e4fa..88a4cb5788 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/README.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/README.md
@@ -1,5 +1,7 @@
 # Az - Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ### OAuth Application
 
 By default, member users can register application objects in Entra ID. Separately, when an application is not yet represented in the tenant, the first user who grants consent causes its service principal to be created there.<sup>[[1]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-automation-accounts-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-automation-accounts-persistence.md
index 1c44304d65..2e22d1b706 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-automation-accounts-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-automation-accounts-persistence.md
@@ -1,5 +1,7 @@
 # Az - Automation Accounts Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Persistence Techniques
 
 For more information about Automation Accounts check:
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md
index 38d06c23c0..ddcd7ba3e2 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md
@@ -1,5 +1,7 @@
 # Az - Cloud Shell Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Shell Persistence
 
 Azure Cloud Shell is an authenticated, browser-accessible Bash or PowerShell terminal for managing Azure resources. When persistent storage is configured, an attacker who can alter the persisted home directory can add startup commands that execute in later Cloud Shell sessions.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-logic-apps-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-logic-apps-persistence.md
index 8b8a621749..21661dc0a1 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-logic-apps-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-logic-apps-persistence.md
@@ -1,5 +1,7 @@
 # Az - Logic Apps Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Logic Apps
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistence.md
index d9f64a4a5c..ef710227d6 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistence.md
@@ -1,5 +1,7 @@
 # Az - Queue Storage Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Queue
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-sql-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-sql-persistence.md
index 2f78cf7f87..36d157c9c1 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-sql-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-sql-persistence.md
@@ -1,5 +1,7 @@
 # Az - SQL Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## SQL
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md
index 06584c5c26..4dd8f312e9 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md
@@ -1,5 +1,7 @@
 # Az - Storage Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage persistence
 
 For more information about storage check:
diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md b/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md
index 32bb399a7b..8cc118f7c3 100644
--- a/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md
+++ b/src/pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md
@@ -1,5 +1,7 @@
 # Az - VMs Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## VMs persistence
 
 For more information about VMs check:
@@ -32,4 +34,3 @@ After obtaining guest or control-plane access, an attacker could backdoor an ins
 - [6] [User Data for Azure Virtual Machine](https://learn.microsoft.com/en-us/azure/virtual-machines/user-data)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/README.md b/src/pentesting-cloud/azure-security/az-post-exploitation/README.md
index 25285392f8..3b5f41c4e4 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/README.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # Az - Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 {{#ref}}
 az-azure-ai-foundry-post-exploitation.md
 {{#endref}}
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-api-management-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-api-management-post-exploitation.md
index cce1537edc..62fcf0bc15 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-api-management-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-api-management-post-exploitation.md
@@ -1,5 +1,7 @@
 # Azure - API Management Post-Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 The permission names below are Azure RBAC actions for the Microsoft.ApiManagement resource provider, and the examples show the corresponding management-plane operations that can disrupt an API Management service.<sup>[[1]](#references)</sup>
 
 The commands use Azure CLI's `az rest` custom-request interface, which supports the HTTP method, URI, headers, and JSON body options shown here.<sup>[[15]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md
index f6a099e27a..53ef41ab56 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md
@@ -1,5 +1,7 @@
 # Azure - AI Foundry Post-Exploitation via Hugging Face Model Namespace Reuse
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Scenario
 
 - Azure AI Foundry Model Catalog includes many Hugging Face (HF) models for one-click deployment.<sup>[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
index 571a9f26d0..a7fd9d0e80 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Blob Storage Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage Privesc
 
 For more information about storage check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md
index cf887b354d..41b69ab252 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Container Registry Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Container Registry
 
 For more information about this service check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md
index 67418ce79a..299dbfb51c 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - CosmosDB Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## CosmosDB Post Exploitation
 
 For more information about Cosmos DB check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md
index b9f253a4e3..4b961a840e 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - File Share Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 For more information about file shares check:
 
 {{#ref}}
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md
index ff057e1476..dddab701bc 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Function Apps Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Function Apps Post Exploitation
 
 For more information about function apps check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md
index 763a1ad252..940c629f99 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Key Vault Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Key Vault
 
 For more information about this service check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-logic-apps-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-logic-apps-post-exploitation.md
index b4f1a4b2bc..d171c36b17 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-logic-apps-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-logic-apps-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Logic Apps Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Logic Apps Post Exploitation
 
 For more information about logic apps check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-mysql-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-mysql-post-exploitation.md
index da1496cda9..16e5df5abe 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-mysql-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-mysql-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - MySQL Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## MySQL Database Post Exploitation
 
 For more information about MySQL Database check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-postgresql-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-postgresql-post-exploitation.md
index 4f3cac354a..230713753c 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-postgresql-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-postgresql-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - PostgreSQL Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## PostgreSQL Database Post Exploitation
 
 For more information about PostgreSQL Database check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md
index 7ab121633b..1e014e0e0f 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Queue Storage Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Queue
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md
index 3bfee5928a..0280a740ec 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Service Bus Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Service Bus
 
 For more information check:
@@ -99,4 +101,3 @@ Take a look here:
 - [8] [Enable dead lettering on message expiration for Azure Service Bus queues and subscriptions - Azure Service Bus](https://learn.microsoft.com/en-us/azure/service-bus-messaging/enable-dead-letter)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md
index 421f1a9fac..ed7bb0daa1 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - SQL Database Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## SQL Database Post Exploitation
 
 For more information about SQL Database check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md
index 73d1f9df78..f8becc2b16 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Table Storage Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Table Storage Post Exploitation
 
 For more information about table storage check:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-virtual-desktop-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-virtual-desktop-post-exploitation.md
index 6cfc81b0c6..71d2b685dc 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-virtual-desktop-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-virtual-desktop-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - Virtual Desktop Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Virtual Desktop
 
 For more info about Virtual Desktop check the following page:
diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md
index 899651e868..9768836a37 100644
--- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md
+++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md
@@ -1,5 +1,7 @@
 # Az - VMs & Network Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## VMs & Network
 
 For more info about Azure VMs and networking check the following page:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md
index 68aa91a361..0400cc865a 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/README.md
@@ -1,6 +1,7 @@
 # Az - Privilege Escalation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-ai-foundry-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-ai-foundry-privesc.md
index 05a6178cca..bfe40da8bd 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-ai-foundry-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-ai-foundry-privesc.md
@@ -1,5 +1,7 @@
 # Az - AI Foundry, AI Hubs, Azure OpenAI & AI Search Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 Azure AI Foundry ties together AI Hubs, AI Projects (Azure ML workspaces), Azure OpenAI, and Azure AI Search. Attackers who gain limited rights over any of these assets can often pivot to managed identities, API keys, or downstream data stores that grant broader access across the tenant. This page summarizes impactful permission sets and how to abuse them for privilege escalation or data theft.
 
 ## `Microsoft.MachineLearningServices/workspaces/hubs/write`, `Microsoft.MachineLearningServices/workspaces/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`
@@ -692,4 +694,3 @@ If a pipeline resolves `faq-clean@1` to the same mutable blob URI, it may ingest
 - [27] [Quickstart: Create, download, and list blobs with Azure CLI](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-cli)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
index ed2bf18d20..ae2b34b144 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
@@ -1,5 +1,7 @@
 # Az - API Management Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 The permission strings below are Azure RBAC operations for the `Microsoft.ApiManagement` resource provider. Their documented effects are used to distinguish read, secret-retrieval, write, and network-configuration capabilities.<sup>[[1]](#references)</sup>
 
 ## `Microsoft.ApiManagement/service/namedValues/read` & `Microsoft.ApiManagement/service/namedValues/listValue/action`
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md
index 8a1337007e..734a642ba9 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md
@@ -1,5 +1,7 @@
 # Az - App Services Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Services
 
 For more information about Azure App services check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md
index 4a3fa32d5c..9380f1e509 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md
@@ -1,5 +1,7 @@
 # Az - Azure IAM Privesc (Authorization)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure IAM
 
 For more information, check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md
index 5cc527a6d0..697f48a9c0 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md
@@ -1,5 +1,7 @@
 # Az - Azure Automation Accounts Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Automation Accounts
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-apps-jobs-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-apps-jobs-privesc.md
index 819559350b..bec09ddbde 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-apps-jobs-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-apps-jobs-privesc.md
@@ -1,5 +1,7 @@
 # Az - Azure Container Instances, Apps & Jobs Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Container Instances, Apps & Jobs
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-registry-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-registry-privesc.md
index a3f92ffb22..3058ad676e 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-registry-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-registry-privesc.md
@@ -1,5 +1,7 @@
 # Az - Azure Container Registry Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Container Registry
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md
index f4b17954d4..54870dbf4a 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md
@@ -1,5 +1,7 @@
 # Az - CosmosDB Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## CosmosDB Privesc
 
 For more information about Azure Cosmos DB, check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md
index a5e38b304b..a30c974774 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md
@@ -1,5 +1,7 @@
 # Az - EntraID Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 > [!NOTE]
 > Not all granular permissions held by Microsoft Entra built-in roles are eligible for custom roles.<sup>[[4]](#references)</sup>
 
@@ -678,4 +680,3 @@ az rest --method GET \
 - [30] [Microsoft Graph application resource basics](https://learn.microsoft.com/en-us/graph/tutorial-applications-basics)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md
index d468cad2a8..6f200fe922 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md
@@ -1,5 +1,7 @@
 # Az - Conditional Access Policies & MFA Bypass
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Conditional Access policies are rules set up in Microsoft Azure to enforce access controls to Azure services and applications based on certain **conditions**. These policies help organizations secure their resources by applying the right access controls under the right circumstances.<sup>[[3]](#references)</sup>\
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md
index 2aba7d9a58..2816ef8d58 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md
@@ -1,5 +1,7 @@
 # Az - Dynamic Groups Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Dynamic groups** use membership **rules** to automatically add or remove matching **users or devices**. When a user or device **attribute** changes, Microsoft Entra evaluates the dynamic membership rules to determine whether group membership should change.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md
index 01080d0f15..e7a53a8c10 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md
@@ -1,5 +1,7 @@
 # Az - Functions App Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Function Apps
 
 Check the following page for more information:
@@ -531,4 +533,3 @@ az functionapp deployment source config \
 - [23] [Functions API · projectkudu/kudu Wiki](https://github.com/projectkudu/kudu/wiki/Functions-API)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md
index ca48a070d9..6ed2facf78 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-key-vault-privesc.md
@@ -1,5 +1,7 @@
 # Az - Key Vault Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Key Vault
 
 For more information about this service check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-logic-apps-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-logic-apps-privesc.md
index 66580e9768..cdcfec73d8 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-logic-apps-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-logic-apps-privesc.md
@@ -1,5 +1,7 @@
 # Az - Logic Apps Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Logic Apps Privesc
 
 For more information about Logic Apps check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-mysql-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-mysql-privesc.md
index edaa548a45..0467a4fb10 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-mysql-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-mysql-privesc.md
@@ -1,5 +1,7 @@
 # Az - MySQL Database Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## MySQL Database Privesc
 
 For more information about Azure Database for MySQL, check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-postgresql-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-postgresql-privesc.md
index e5f0e8bcbe..8e366b52a8 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-postgresql-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-postgresql-privesc.md
@@ -1,5 +1,7 @@
 # Az - PostgreSQL Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## PostgreSQL Privesc
 
 For more information about Azure Database for PostgreSQL, check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md
index 1a84c5aba5..dd6185cded 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md
@@ -1,5 +1,7 @@
 # Az - Queue Storage Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Queue
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md
index e20c256498..80ef7c2264 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md
@@ -1,5 +1,7 @@
 # Az - Service Bus Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Service Bus
 
 For more information check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md
index 1009e9e433..e455f42e2b 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md
@@ -1,5 +1,7 @@
 # Az - SQL Database Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## SQL Database Privesc
 
 For more information about SQL Database check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-static-web-apps-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-static-web-apps-privesc.md
index fe7da77a05..6225b93d48 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-static-web-apps-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-static-web-apps-privesc.md
@@ -1,5 +1,7 @@
 # Az - Static Web Apps Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Static Web Apps
 
 For more information about this service check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md
index 9d540d9772..47118ed556 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md
@@ -1,5 +1,7 @@
 # Az - Storage Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage Privesc
 
 For more information about storage check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-desktop-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-desktop-privesc.md
index 30994f6e79..2f8e138d70 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-desktop-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-desktop-privesc.md
@@ -1,5 +1,7 @@
 # Az - Virtual Desktop Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Virtual Desktop Privesc
 
 For more info about Azure Virtual Desktop check:
diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md
index c454436922..b38ea532b7 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md
@@ -1,5 +1,7 @@
 # Az - Virtual Machines & Network Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## VMS & Network
 
 For more info about Azure Virtual Machines and Network check:
diff --git a/src/pentesting-cloud/azure-security/az-services/README.md b/src/pentesting-cloud/azure-security/az-services/README.md
index 40da970900..39061d5a21 100644
--- a/src/pentesting-cloud/azure-security/az-services/README.md
+++ b/src/pentesting-cloud/azure-security/az-services/README.md
@@ -1,5 +1,7 @@
 # Az - Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Portals
 
 You can find a community-maintained list of Microsoft portals at [**MSPortals.io**](https://msportals.io/).<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-acr.md b/src/pentesting-cloud/azure-security/az-services/az-acr.md
index 89fb7a4e4e..965af1ac08 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-acr.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-acr.md
@@ -1,5 +1,7 @@
 # Az - ACR
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Container Registry (ACR) is a managed service provided by Microsoft Azure for **storing and managing Docker container images and other artifacts**. It offers features such as integrated developer tools, geo-replication, security measures like role-based access control and image scanning, automated builds, webhooks and triggers, and network isolation. It works with popular tools like Docker CLI and Kubernetes, and integrates well with other Azure services.<sup>[[2]](#references)</sup>
@@ -57,4 +59,3 @@ docker pull <corp-name>.azurecr.io/<image>:<tag>
 - [4] [Microsoft Learn - Get-AzContainerRegistry](https://learn.microsoft.com/en-us/powershell/module/az.containerregistry/get-azcontainerregistry?view=azps-16.2.0)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-services/az-ai-foundry.md b/src/pentesting-cloud/azure-security/az-services/az-ai-foundry.md
index 8951884f08..4d1e333f2b 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-ai-foundry.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-ai-foundry.md
@@ -1,5 +1,7 @@
 # Az - AI Foundry, AI Hubs, Azure OpenAI & AI Search
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Why These Services Matter
 
 Microsoft Foundry (formerly Azure AI Foundry) is Microsoft's platform for building generative-AI applications. In the classic architecture, a hub groups projects with shared security, connections, compute, and dependent resources, including storage, Key Vault, container registry, and monitoring resources.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-api-management.md b/src/pentesting-cloud/azure-security/az-services/az-api-management.md
index dfad1ea272..c06a96e73d 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-api-management.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-api-management.md
@@ -1,5 +1,7 @@
 # Az - API Management
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure API Management (APIM) provides a management plane, API gateways, and a developer portal for publishing, protecting, transforming, and monitoring APIs. It sits between clients and backend services and applies centrally configured routing and policy behavior.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-app-services.md b/src/pentesting-cloud/azure-security/az-services/az-app-services.md
index 759339e92e..7ab889c1c6 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-app-services.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-app-services.md
@@ -1,5 +1,7 @@
 # Az - App Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Service Basic Information
 
 Azure App Services enables developers to **build, deploy, and scale web applications, mobile app backends, and APIs seamlessly**. It supports multiple programming languages and integrates with various Azure tools and services for enhanced functionality and management.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md b/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md
index 8c48e6851b..0caf566981 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-application-proxy.md
@@ -1,5 +1,7 @@
 # Az - Application Proxy
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Microsoft Entra application proxy provides **secure remote access to on-premises web applications**. After a **single sign-on to Microsoft Entra ID**, users can access both **cloud** and **on-premises applications** through an **external URL** or an internal application portal.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md b/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md
index aa28c43f4c..bd0aac477a 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-arm-templates.md
@@ -1,5 +1,7 @@
 # Az - ARM Templates / Deployments
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 For infrastructure as code, an Azure Resource Manager template (ARM template) is a **JSON** document that declares the Azure infrastructure and configuration to deploy. Its declarative syntax describes the resources and their properties without requiring an imperative sequence of creation commands.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-automation-accounts.md b/src/pentesting-cloud/azure-security/az-services/az-automation-accounts.md
index d01b377f4d..ca095b3732 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-automation-accounts.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-automation-accounts.md
@@ -1,5 +1,7 @@
 # Az - Automation Accounts
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Automation accounts provide cloud-hosted process automation for Azure and hybrid environments. **Runbooks** contain the automation logic, **jobs** represent executions, schedules and webhooks trigger work, and Hybrid Runbook Workers execute runbooks outside the Azure sandbox.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-azuread.md b/src/pentesting-cloud/azure-security/az-services/az-azuread.md
index a3380928bc..1265fecc5a 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-azuread.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-azuread.md
@@ -1,5 +1,7 @@
 # Az - Entra ID (AzureAD) & Azure IAM
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Microsoft Entra ID (formerly Azure Active Directory or Azure AD) is Microsoft's cloud identity and access-management service. It authenticates and authorizes access to Microsoft 365, Azure, and integrated SaaS applications, and provides directory management for users and other identities.<sup>[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-cloud-shell.md b/src/pentesting-cloud/azure-security/az-services/az-cloud-shell.md
index 4c91c828d2..1e0ee4589a 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-cloud-shell.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-cloud-shell.md
@@ -1,5 +1,7 @@
 # Az - Cloud Shell
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Cloud Shell
 
 **Azure Cloud Shell** is an interactive, authenticated, browser-accessible terminal designed for managing Azure resources, offering the flexibility to work with either Bash or PowerShell. It runs on a temporary, per-session host that times out after 20 minutes of inactivity, while persisting files in the `$HOME` location using a 5-GB file share. Cloud Shell can be accessed through multiple points, including the Azure portal, shell.azure.com, Azure CLI and PowerShell documentation, the Azure mobile app, and the Visual Studio Code Azure Account extension.<sup>[[1]](#references)[[3]](#references)</sup>
@@ -137,4 +139,3 @@ The following policy definition can audit, deny, or disable the creation of auto
 
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md b/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md
index 6b10ee54b9..e354d35d48 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md
@@ -1,5 +1,7 @@
 # Az - Container Instances
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Azure Container Instances (ACI)** is a serverless container service that lets you run individual containers quickly without managing any underlying infrastructure. **Azure Container Apps (ACA)** extends this by offering a fully managed environment for running microservices and web apps with features like event-driven autoscaling, built-in Dapr integration, and support for complex orchestration scenarios. **Container App Jobs** are a specialized feature within ACA designed for running short-lived, batch, or scheduled tasks that execute for a finite period and then exit.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-container-registry.md b/src/pentesting-cloud/azure-security/az-services/az-container-registry.md
index dc513553e7..2ab4bcc2ca 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-container-registry.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-container-registry.md
@@ -1,5 +1,7 @@
 # Az - Container Registry
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Container Registry (ACR) is a managed registry service for **storing and managing container images and related artifacts**. It integrates with container development and deployment pipelines, supports Azure Container Registry Tasks for cloud builds, and offers geo-replication in the Premium tier. Microsoft Defender for Cloud can scan registry images for vulnerabilities when configured.<sup>[[3]](#references)[[9]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md b/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md
index 52d246d21a..e7369ee2f4 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-cosmosDB.md
@@ -1,5 +1,7 @@
 # Az - CosmosDB
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure CosmosDB
 
 **Azure Cosmos DB** is a fully **managed NoSQL, relational, and vector database** offering single-digit millisecond response times, automatic scalability, and SLA-backed availability with enterprise-grade security. It enables faster app development through turnkey multi-region data distribution, open-source APIs, SDKs for popular languages, and AI database features like integrated vector support and seamless Azure AI integration.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-defender.md b/src/pentesting-cloud/azure-security/az-services/az-defender.md
index 4b03756ce9..cd04425e1e 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-defender.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-defender.md
@@ -1,5 +1,7 @@
 # Az - Defender
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Microsoft Defender for Cloud
 
 Microsoft Defender for Cloud is a Cloud Native Application Protection Platform (CNAPP) that combines Cloud Security Posture Management (CSPM), Development Security Operations (DevSecOps), and Cloud Workload Protection Platform (CWPP) capabilities. It provides a unified view of security posture across cloud and on-premises resources, supports hybrid and multicloud environments, and protects workloads such as virtual machines, containers, storage, databases, and serverless functions.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-file-shares.md b/src/pentesting-cloud/azure-security/az-services/az-file-shares.md
index 9333763a87..5580d34ed7 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-file-shares.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-file-shares.md
@@ -1,5 +1,7 @@
 # Az - File Shares
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Azure Files** is a managed file-storage service that exposes shares through **SMB (Server Message Block)** or **NFS (Network File System)**. SMB supports Windows, Linux, and macOS clients, while NFS targets Linux/UNIX workloads. Shares can be mounted concurrently from Azure or on-premises clients when the required network path is available.<sup>[[1]](#references)[[6]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-front-door.md b/src/pentesting-cloud/azure-security/az-services/az-front-door.md
index 4564a3cf22..d6d234dea4 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-front-door.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-front-door.md
@@ -1,5 +1,7 @@
 # Az - Front Door
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## RemoteAddr Bypass
 
 This **[blog post](https://trustedsec.com/blog/azures-front-door-waf-wtf-ip-restriction-bypass)** explains how, when configuring network restrictions with Azure Front Door, you can filter on **`RemoteAddr`** or **`SocketAddr`**. The important difference is that **`RemoteAddr`** uses the original client address, usually from the **`X-Forwarded-For`** HTTP header, while **`SocketAddr`** is the source address seen by the WAF; an attacker can therefore supply an allowed address in `X-Forwarded-For` when a rule uses `RemoteAddr`.<sup>[[1]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-function-apps.md b/src/pentesting-cloud/azure-security/az-services/az-function-apps.md
index 84c8246f5c..00edbb872a 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-function-apps.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-function-apps.md
@@ -1,5 +1,7 @@
 # Az - Function Apps
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Azure Function Apps** are a **serverless compute service** that allow you to run small pieces of code, called **functions**, without managing the underlying infrastructure. They are designed to execute code in response to various triggers, such as **HTTP requests, timers, or events from other Azure services** like Blob Storage or Event Hubs. Function Apps support multiple programming languages, including C#, Python, JavaScript, and Java, making them versatile for building **event-driven applications**, automating workflows, or integrating services. They are cost-effective, as you usually only pay for the compute time used when your code runs.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-keyvault.md b/src/pentesting-cloud/azure-security/az-services/az-keyvault.md
index 1f7e00d94e..8f9b86cb0a 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-keyvault.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-keyvault.md
@@ -1,5 +1,7 @@
 # Az - Key Vault
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Azure Key Vault** is a Microsoft Azure service for securely storing and accessing sensitive information such as **secrets, keys, certificates, passwords, and API keys**. It centralizes this material and uses **Microsoft Entra ID** for authentication, with authorization through **Azure role-based access control (RBAC)** or legacy Key Vault access policies. Vault data is encrypted at rest, Key Vault enforces TLS for data in transit, and the service supports software- and HSM-protected keys. It also supports **audit logging** that can be analyzed in Azure Monitor and autorotation features that reduce the exposure window for cryptographic material.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[8]](#references)[[10]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-logic-apps.md b/src/pentesting-cloud/azure-security/az-services/az-logic-apps.md
index 812972edc7..ac567a800f 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-logic-apps.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-logic-apps.md
@@ -1,5 +1,7 @@
 # Az - Logic Apps
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Logic Apps enables developers to **create and run workflows that integrate various services**, data sources, and applications. These workflows are designed to **automate business processes**, orchestrate tasks, and perform data integrations across different platforms.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md b/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md
index caafcded04..53696c5c55 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md
@@ -1,5 +1,7 @@
 # Az - Management Groups, Subscriptions & Resource Groups
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Management Groups
 
 You can find more info about Management Groups in:
@@ -65,4 +67,3 @@ az group list --subscription "<subscription>" --output table
 - [4] [az group | Microsoft Learn](https://learn.microsoft.com/en-us/cli/azure/group?view=azure-cli-latest)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-services/az-misc.md b/src/pentesting-cloud/azure-security/az-services/az-misc.md
index 518ee19eea..ff6aedeca3 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-misc.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-misc.md
@@ -1,5 +1,7 @@
 # Az - Misc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Power Apps
 
 Power Apps can connect to on-premises SQL Server through an on-premises data gateway, which bridges Microsoft cloud services and on-premises data.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-monitoring.md b/src/pentesting-cloud/azure-security/az-services/az-monitoring.md
index 4ff3313d39..758d29bd70 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-monitoring.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-monitoring.md
@@ -1,5 +1,7 @@
 # Az - Monitoring
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Entra ID - Logs
 
 There are 3 types of logs available in Entra ID.<sup>[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-mysql.md b/src/pentesting-cloud/azure-security/az-services/az-mysql.md
index 656f5a17d2..fb5ad5384f 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-mysql.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-mysql.md
@@ -1,5 +1,7 @@
 # Az - MySQL Databases
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure MySQL
 Azure Database for MySQL is a fully managed relational database service based on the MySQL Community Edition. The service historically offered two deployment models, but Flexible Server is the current deployment model.<sup>[[1]](#references)[[2]](#references)</sup>
 
diff --git a/src/pentesting-cloud/azure-security/az-services/az-postgresql.md b/src/pentesting-cloud/azure-security/az-services/az-postgresql.md
index f5956cf2a7..9a15d2acc2 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-postgresql.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-postgresql.md
@@ -1,5 +1,7 @@
 # Az - PostgreSQL Databases
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure PostgreSQL
 **Azure Database for PostgreSQL** is a fully managed **relational database service based on the PostgreSQL** Community Edition. It is designed to provide scalability, security, and flexibility for diverse application needs.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
 
diff --git a/src/pentesting-cloud/azure-security/az-services/az-queue.md b/src/pentesting-cloud/azure-security/az-services/az-queue.md
index 03afce5c45..69a2c99df7 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-queue.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-queue.md
@@ -1,5 +1,7 @@
 # Az - Queue Storage
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Queue Storage provides asynchronous messaging between decoupled application components. A queue can contain millions of messages up to the storage account's capacity, and each message can be up to 64 KB. Messages are normally added at the back and retrieved from the front, but strict first-in-first-out (FIFO) ordering is not guaranteed.<sup>[[1]](#references)[[2]](#references)[[7]](#references)</sup>
@@ -96,4 +98,3 @@ $queueMessage.Value
 - [7] [Introduction to Azure Queue Storage](https://learn.microsoft.com/en-us/azure/storage/queues/storage-queues-introduction)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/azure-security/az-services/az-sentinel.md b/src/pentesting-cloud/azure-security/az-services/az-sentinel.md
index ab51e89ad2..339a258ac2 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-sentinel.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-sentinel.md
@@ -1,5 +1,7 @@
 # Az - Sentinel
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Microsoft Sentinel
 
 Microsoft Sentinel is a cloud-native **SIEM** (Security Information and Event Management) and **SOAR** (Security Orchestration, Automation, and Response) solution.<sup>[[2]](#references)[[18]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-servicebus.md b/src/pentesting-cloud/azure-security/az-services/az-servicebus.md
index 0c386e8276..a031df8ab5 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-servicebus.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-servicebus.md
@@ -1,5 +1,7 @@
 # Az - Service Bus Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Service Bus
 
 Azure Service Bus is a fully managed enterprise **message broker** with queues and publish-subscribe topics. It decouples applications and services, supports load balancing across competing workers, routes data and control across service boundaries, and coordinates reliable transactional work; producers and consumers do not need to be available at the same time.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-sql.md b/src/pentesting-cloud/azure-security/az-services/az-sql.md
index 8da4dbdb03..eeac879384 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-sql.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-sql.md
@@ -1,5 +1,7 @@
 # Az - SQL
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure SQL
 
 Azure SQL is a family of managed, secure, and intelligent products that use the **SQL Server database engine in the Azure cloud**. This means you don't have to worry about the physical administration of your servers, and you can focus on managing your data.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-static-web-apps.md b/src/pentesting-cloud/azure-security/az-services/az-static-web-apps.md
index a0c3e18329..d10d2b4007 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-static-web-apps.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-static-web-apps.md
@@ -1,5 +1,7 @@
 # Az Static Web Apps
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Static Web Apps Basic Information
 
 Azure Static Web Apps is a cloud service for hosting **static web apps with automatic CI/CD from repositories like GitHub**. It offers global content delivery, serverless backends, and built-in HTTPS, making it secure and scalable.<sup>[[3]](#references)</sup> However, even if the service is called "static", it doesn't mean it's completely safe. Risks include misconfigured CORS, insufficient authentication, and content tampering, which can expose apps to attacks like XSS and data leakage if not properly managed.
diff --git a/src/pentesting-cloud/azure-security/az-services/az-storage.md b/src/pentesting-cloud/azure-security/az-services/az-storage.md
index e36d5eb646..1232952774 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-storage.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-storage.md
@@ -1,5 +1,7 @@
 # Az - Storage Accounts & Blobs
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure Storage Accounts are fundamental services in Microsoft Azure that provide scalable, secure, and highly available cloud **storage for various data types**, including blobs (binary large objects), files, queues, and tables. They serve as containers that group these different storage services together under a single namespace for easy management.<sup>[[1]](#references)[[14]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-table-storage.md b/src/pentesting-cloud/azure-security/az-services/az-table-storage.md
index 47b8dd89b3..f6f8ff8c4f 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-table-storage.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-table-storage.md
@@ -1,5 +1,7 @@
 # Az - Table Storage
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Azure Table Storage** is a NoSQL key-value store designed for storing large volumes of structured, non-relational data. It offers high availability, low latency, and scalability to handle large datasets efficiently. Data is organized into tables, with each entity identified by a partition key and row key, enabling fast lookups. It supports features like encryption at rest, role-based access control, and shared access signatures for secure, managed storage suitable for a wide range of applications.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/az-virtual-desktop.md b/src/pentesting-cloud/azure-security/az-services/az-virtual-desktop.md
index a2aa496f2f..b619ef3d9f 100644
--- a/src/pentesting-cloud/azure-security/az-services/az-virtual-desktop.md
+++ b/src/pentesting-cloud/azure-security/az-services/az-virtual-desktop.md
@@ -1,5 +1,7 @@
 # Az - Virtual Desktop
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Virtual Desktop
 
 Azure Virtual Desktop is a **desktop and app virtualization service** running on Azure. It can deliver full Windows 11, Windows 10, or Windows Server desktops, or individual applications through RemoteApp. It supports single-session deployments for dedicated users and multi-session deployments for pooled use, and users can connect with Windows App from native clients or a web browser.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/intune.md b/src/pentesting-cloud/azure-security/az-services/intune.md
index d13f5bf6e6..0bdb19fc07 100644
--- a/src/pentesting-cloud/azure-security/az-services/intune.md
+++ b/src/pentesting-cloud/azure-security/az-services/intune.md
@@ -1,5 +1,7 @@
 # Az - Intune
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Microsoft Intune is designed to streamline the process of **app and device management**. Its capabilities extend across a diverse range of devices, encompassing mobile devices, desktop computers, and virtual endpoints. The core functionality of Intune revolves around **managing user access and simplifying the administration of applications** and devices within an organization's network.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-services/vms/README.md b/src/pentesting-cloud/azure-security/az-services/vms/README.md
index 391aa35453..192cfd031f 100644
--- a/src/pentesting-cloud/azure-security/az-services/vms/README.md
+++ b/src/pentesting-cloud/azure-security/az-services/vms/README.md
@@ -1,5 +1,7 @@
 # Az - Virtual Machines & Network
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Azure Networking Basic Info
 
 Azure networks contains **different entities and ways to configure it.** You can find a brief **descriptions,** **examples** and **enumeration** commands of the different Azure network entities in:
diff --git a/src/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md b/src/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md
index 7bde1cbefc..4a3c7b6ac8 100644
--- a/src/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md
+++ b/src/pentesting-cloud/azure-security/az-services/vms/az-azure-network.md
@@ -1,5 +1,7 @@
 # Az - Azure Network
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Azure provides **virtual networks (VNet)** that allows users to create **isolated** **networks** within the Azure cloud. Within these VNets, resources such as virtual machines, applications, databases... can be securely hosted and managed. The networking in Azure supports both the communication within the cloud (between Azure services) and the connection to external networks and the internet.\
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md
index bc8fd6a032..81239f6e7e 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md
@@ -1,5 +1,7 @@
 # Az - Unauthenticated Enum & Initial Entry
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Azure Tenant
 
 ### Tenant Enumeration
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-container-registry-unauth.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-container-registry-unauth.md
index 96d7473fef..dad2b28ff2 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-container-registry-unauth.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-container-registry-unauth.md
@@ -1,5 +1,7 @@
 # Az - Container Registry Unauth
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Container Registry Unauth
 
 For more information about container registries, check:
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md
index 83dd474374..49b92dfb2d 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md
@@ -1,5 +1,7 @@
 # Az - Device Code Authentication Phishing
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Device code phishing** abuses the OAuth 2.0 **Device Authorization Grant** so the victim authenticates on the **legitimate** Microsoft page `https://microsoft.com/devicelogin`, completes the real MFA challenge, and still gives the attacker the resulting tokens.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)[[7]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-monitor-alert-phishing.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-monitor-alert-phishing.md
index 6223054b47..115745b4cb 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-monitor-alert-phishing.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-monitor-alert-phishing.md
@@ -1,5 +1,7 @@
 # Az - Monitor Alert Phishing
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Monitor Alert Phishing
 
 At the time of the original report, it was possible to bypass the Azure Monitor Action Group notification that a user had been added to a monitoring group. This allowed an attacker to send email to arbitrary addresses with partially customizable alert text and subjects from `azure-noreply@microsoft.com`, with valid Microsoft email authentication.<sup>[[8]](#references)[[9]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-oauth-apps-phishing.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-oauth-apps-phishing.md
index 986b74ff60..d21cb73a36 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-oauth-apps-phishing.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-oauth-apps-phishing.md
@@ -1,5 +1,7 @@
 # Az - OAuth Apps Phishing
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## OAuth App Phishing
 
 **Microsoft Entra applications** can request delegated permissions (scopes) exposed by Microsoft Graph and other APIs. After consent, a delegated token lets the application act on behalf of the signed-in user; it cannot access data that user could not access. Application permissions are a separate app-only model and are not constrained to a signed-in user's permissions.<sup>[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-password-spraying.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-password-spraying.md
index 05be78ba72..ff988194dc 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-password-spraying.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-password-spraying.md
@@ -1,5 +1,7 @@
 # Az - Password Spraying
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Password Spray
 
 Against **Microsoft Entra ID** and **Microsoft 365**, password spraying can reach multiple authentication paths, including the OAuth2 modules implemented by **o365spray**. The legacy Azure AD Graph service mentioned in older material has been retired; Microsoft directs applications to Microsoft Graph instead.<sup>[[4]](#references)[[6]](#references)</sup>
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md
index ac0b261104..790576d1ab 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md
@@ -1,5 +1,7 @@
 # Az - Storage Unauth
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage Unauth
 
 For more information about storage check:
diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-vms-unauth.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-vms-unauth.md
index e02094fde8..9c2763b845 100644
--- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-vms-unauth.md
+++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-vms-unauth.md
@@ -1,5 +1,7 @@
 # Az - VMs Unauth
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Virtual Machines
 
 For more info about Azure Virtual Machines check:
@@ -48,4 +50,3 @@ az vm extension image list --publisher "Site24x7" --output table
 - [4] [az vm extension image | Microsoft Learn](https://learn.microsoft.com/en-us/cli/azure/vm/extension/image?view=azure-cli-latest)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/confidential-computing/luks2-header-malleability-null-cipher-abuse.md b/src/pentesting-cloud/confidential-computing/luks2-header-malleability-null-cipher-abuse.md
index 05f3acc6e0..d901614e5c 100644
--- a/src/pentesting-cloud/confidential-computing/luks2-header-malleability-null-cipher-abuse.md
+++ b/src/pentesting-cloud/confidential-computing/luks2-header-malleability-null-cipher-abuse.md
@@ -1,5 +1,7 @@
 # LUKS2 Header Malleability and Null-Cipher Abuse in Confidential VMs
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## TL;DR
 
 - Many Linux-based Confidential VMs (CVMs) running on AMD SEV-SNP or Intel TDX use LUKS2 for persistent storage. The on-disk LUKS2 header is malleable and not integrity-protected against storage-adjacent attackers.<sup>[[1]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/README.md b/src/pentesting-cloud/digital-ocean-pentesting/README.md
index da17573c04..df11fe6d19 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/README.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/README.md
@@ -1,5 +1,7 @@
 # Digital Ocean Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Before pentesting** a DigitalOcean environment, there are a few **basic concepts you need to know** about how DigitalOcean works. These concepts help you understand what to enumerate, how to find misconfigurations, and how they might be exploited.
@@ -46,4 +48,3 @@ do-services/
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-basic-information.md b/src/pentesting-cloud/digital-ocean-pentesting/do-basic-information.md
index dea741e5ce..7fb699091b 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-basic-information.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-basic-information.md
@@ -1,5 +1,7 @@
 # DO - Basic Information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean is a cloud computing platform for building, deploying, and managing applications. Its product catalog includes virtual machines, managed containers, a PaaS, serverless functions, managed databases, and several storage and networking services.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-permissions-for-a-pentest.md b/src/pentesting-cloud/digital-ocean-pentesting/do-permissions-for-a-pentest.md
index 8e5ee2fa62..9c590c322c 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-permissions-for-a-pentest.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-permissions-for-a-pentest.md
@@ -1,5 +1,7 @@
 # DO - Permissions for a Pentest
 
+{{#include ../../banners/hacktricks-training.md}}
+
 For a read-only review of a team's shared resources, assign the pentester the predefined **Resource Viewer** role. It provides read-only access to shared resources and team settings without billing access. If the test requires changes, prefer **Modifier** when possible because it can modify shared resources but cannot delete them. The **Member** role has full access to shared resources, so grant it only when the agreed scope requires actions unavailable to the less privileged roles. A user's team role also limits the scopes available to their personal API tokens.<sup>[[1]](#references)</sup>
 
 For a narrower least-privilege assignment, create a custom role containing only the permissions required by the test. Custom roles can be created only in the control panel, not through the DigitalOcean API or `doctl`, and they are not automatically updated with permissions for newly released products or features.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/README.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/README.md
index b0660b8742..4e1149af22 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/README.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/README.md
@@ -1,5 +1,7 @@
 # DO - Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 DigitalOcean offers compute, data, storage, container and image, networking, and management services. The following sections explain how to **enumerate them:**<sup>[[1]](#references)</sup>
 
 - [**Apps**](do-apps.md)
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-apps.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-apps.md
index cd2346355a..2285b4143b 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-apps.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-apps.md
@@ -1,5 +1,7 @@
 # DO - Apps
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean App Platform is a managed Platform-as-a-Service (PaaS) that deploys applications from Git repositories or container images and handles the underlying build, deployment, scaling, and infrastructure.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-container-registry.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-container-registry.md
index 8791e230c1..a488a29c74 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-container-registry.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-container-registry.md
@@ -1,5 +1,7 @@
 # DO - Container Registry
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean Container Registry (DOCR) is a **private** registry for storing and managing container images. It integrates with Docker environments and DigitalOcean Kubernetes clusters.<sup>[[1]](#references)</sup>
@@ -41,4 +43,3 @@ doctl registry repository list-v2
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-databases.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-databases.md
index f1560fe106..6039e4fad8 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-databases.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-databases.md
@@ -1,5 +1,7 @@
 # DO - Databases
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean Managed Databases provides managed database clusters with backups, TLS encryption, automated failover, and VPC networking. The currently documented engines are **PostgreSQL**, **MySQL**, **Kafka**, **MongoDB**, **Valkey**, and **OpenSearch**.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md
index 4d62828c96..81b88ec89d 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-droplets.md
@@ -1,5 +1,7 @@
 # DO - Droplets
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 In DigitalOcean, a **Droplet** is a Linux-based virtual machine (VM). Its plan determines resources such as CPU, memory, and storage.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md
index 93d970d70e..84d66d5394 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-functions.md
@@ -1,5 +1,7 @@
 # DO - Functions
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean Functions, also known as "DO Functions," is a serverless computing platform that lets you **run code without managing the underlying infrastructure**. Functions can be invoked through the **authenticated REST API**, exposed as **web functions** for normal HTTP requests, or attached to scheduled triggers that use **cron** expressions.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md
index 1af1f11bf5..09613a6676 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-images.md
@@ -1,5 +1,7 @@
 # DO - Images
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean Images are reusable disk images from which new Droplets can be created. DigitalOcean distinguishes five image types: distribution images, preconfigured 1-Click Applications, uploaded custom images, on-demand snapshots, and automatically created backups.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md
index e2a86c1471..09eed58654 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-kubernetes-doks.md
@@ -1,5 +1,7 @@
 # DO - Kubernetes (DOKS)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 ### DigitalOcean Kubernetes (DOKS)
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md
index 9554e514dd..414c3071b4 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-networking.md
@@ -1,5 +1,7 @@
 # DO - Networking
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ### Domains
 
 List the domains in the account and the DNS records for a specific domain. The domain-record commands also support creating records.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md
index 68340f3f45..8a178e6a1c 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-projects.md
@@ -1,5 +1,7 @@
 # DO - Projects
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 A DigitalOcean Project is a high-level organizational container for related resources, including Droplets, Spaces buckets, database clusters, Kubernetes clusters, load balancers, domains, and App Platform apps.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md
index d6ab178ff3..4f05e4cdcf 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-spaces.md
@@ -1,5 +1,7 @@
 # DO - Spaces
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean Spaces is an **S3-compatible object storage** service for data such as media files and backups. A bucket gets its own URL, whose hostname incorporates the selected datacenter region. Operators can manage Spaces in the DigitalOcean control panel or through compatible APIs and clients, including from Droplets.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md
index 79bcbcbeee..189f258fc3 100644
--- a/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md
+++ b/src/pentesting-cloud/digital-ocean-pentesting/do-services/do-volumes.md
@@ -1,5 +1,7 @@
 # DO - Volumes
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 DigitalOcean Volumes are **network-attached block storage** devices that can be attached to and detached from Droplets. They are independent resources intended for persistent workloads such as databases and file storage, and they can be moved, enlarged, or captured in snapshots.<sup>[[1]](#references)</sup>
@@ -21,4 +23,3 @@ The command lists the block storage volumes available to the authenticated accou
 - [3] [doctl compute volume list](https://docs.digitalocean.com/reference/doctl/reference/compute/volume/list/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/README.md b/src/pentesting-cloud/gcp-security/README.md
index e0e011fff8..75e7e2a297 100644
--- a/src/pentesting-cloud/gcp-security/README.md
+++ b/src/pentesting-cloud/gcp-security/README.md
@@ -1,5 +1,7 @@
 # GCP Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Before start pentesting** a **GCP** environment, there are a few **basics things you need to know** about how it works to help you understand what you need to do, how to find misconfigurations and how to exploit them.
diff --git a/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md b/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md
index 8dec1d4003..24e254f030 100644
--- a/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-basic-information/README.md
@@ -1,5 +1,7 @@
 # GCP - Basic Information
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## **Resource hierarchy**
 
 Google Cloud uses a [Resource hierarchy](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy) that is similar, conceptually, to that of a traditional filesystem. This provides a logical parent/child workflow with specific attachment points for policies and permissions.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md b/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md
index 4c5c57ce8c..65ec042fad 100644
--- a/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md
+++ b/src/pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md
@@ -1,5 +1,7 @@
 # GCP - Federation Abuse
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## OIDC - Github Actions Abuse
 
 ### GCP
diff --git a/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md b/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md
index 6f999f0d64..231611ca7a 100644
--- a/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md
+++ b/src/pentesting-cloud/gcp-security/gcp-permissions-for-a-pentest.md
@@ -1,5 +1,7 @@
 # GCP - Permissions for a Pentest
 
+{{#include ../../banners/hacktricks-training.md}}
+
 If you want to pentest a GCP environment you need to ask for enough permissions to **check all or most of the services** used in **GCP**. Ideally, you should ask the client to create:
 
 * **Create** a new **project**
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/README.md b/src/pentesting-cloud/gcp-security/gcp-persistence/README.md
index b3b60163e9..bb8edb5022 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/README.md
@@ -1,6 +1,7 @@
 # GCP - Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md
index a3e3f1367e..2798179cf7 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-api-keys-persistence.md
@@ -1,5 +1,7 @@
 # GCP - API Keys Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## API Keys
 
 For more information about API Keys check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md
index 5df10beddd..aa4bc56e2c 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-app-engine-persistence.md
@@ -1,5 +1,7 @@
 # GCP - App Engine Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Engine
 
 For more information about App Engine check:
@@ -37,4 +39,3 @@ The version-specific URL follows `https://VERSION_ID-dot-SERVICE-dot-PROJECT_ID.
 - [3] [Test and deploy your application | App Engine standard environment](https://cloud.google.com/appengine/docs/standard/testing-and-deploying-your-app)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md
index 4f975cec0a..6318951ad8 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-artifact-registry-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Artifact Registry Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Artifact Registry
 
 For more information about Artifact Registry check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md
index 2f21648dbe..aaa006fec6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigquery-persistence.md
@@ -1,5 +1,7 @@
 # GCP - BigQuery Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## BigQuery
 
 For more information about BigQuery check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigtable-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigtable-persistence.md
index e0f1331aab..34fda8a583 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigtable-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-bigtable-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Bigtable Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Bigtable
 
 For more information about Bigtable check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md
index fb35009ff4..e0b4fc5a23 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-functions-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Functions Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Functions
 
 For more info about Cloud Functions check:
@@ -23,4 +25,3 @@ For more info about Cloud Functions check:
 - [5] [Cloud Run function triggers](https://docs.cloud.google.com/run/docs/function-triggers)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md
index a5aa5219ac..c17e36b19e 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-run-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Run Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Run
 
 For more information about Cloud Run check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md
index ed85c641c8..096e56eee1 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-shell-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Shell Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Shell
 
 For more information check:
@@ -106,4 +108,3 @@ For managed Google Workspace or Cloud Identity accounts, administrators can disa
 - [15] [Free Google Cloud features and trial offer](https://docs.cloud.google.com/free/docs/free-cloud-features)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md
index e77ae9b54e..eb14a6f19d 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-cloud-sql-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Cloud SQL Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud SQL
 
 For more information about Cloud SQL check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md
index 26802bf2d9..05636d23e9 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-compute-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Compute Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Compute
 
 For more information about Compute and VPC (Networking), check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md
index 1256dd1152..1b016dc44d 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-dataflow-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Dataflow Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Dataflow
 
 ### Invisible persistence in built container
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md
index 96ae91f1e4..5eaa7910ff 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-filestore-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Filestore Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Filestore
 
 For more information about Filestore check:
@@ -63,4 +65,3 @@ For mounting the share and validating access from a controlled client, see:
 - [3] [IAM roles and permissions](https://docs.cloud.google.com/filestore/docs/iam)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md
index ffc67daa12..9c04ecfd30 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-logging-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Logging Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Logging
 
 Find more information about Logging in:
@@ -34,4 +36,3 @@ gcloud logging sinks create <sink-name> <destination> --log-filter="FILTER_CONDI
 {{#include ../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistence.md
index 00043cd441..895d1bac28 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Token Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ### Authenticated User Tokens
 
 To get the **current token** of a user you can run:<sup>[[1]](#references)[[3]](#references)</sup>
@@ -139,4 +141,3 @@ Netskope's [remediation guidance](https://www.netskope.com/blog/gcp-oauth-token-
 - [11] [Authenticate workloads to Google Cloud APIs using service accounts](https://docs.cloud.google.com/compute/docs/access/authenticate-workloads)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md
index 60dc2e7a48..0cb93dcb85 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-secret-manager-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Secret Manager Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Secret Manager
 
 Find more information about Secret Manager in:
@@ -27,4 +29,3 @@ An attacker who can update the secret's metadata could:
 - [4] [REST Resource: projects.secrets](https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md
index 08e242a310..d398bd78b0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md
+++ b/src/pentesting-cloud/gcp-security/gcp-persistence/gcp-storage-persistence.md
@@ -1,5 +1,7 @@
 # GCP - Storage Persistence
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage
 
 For more information about Cloud Storage check:
@@ -57,4 +59,3 @@ Another exploit script for this method can be found [here](https://github.com/Rh
 - [5] [Cloud Storage HMAC key exploit script](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/storage.hmacKeys.create.py)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md
index 7987a89882..6c6fab10bb 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md
@@ -1,5 +1,7 @@
 # GCP - Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-apigee-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-apigee-post-exploitation.md
index b9904486ff..f77585cac4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-apigee-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-apigee-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Apigee Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Apigee metadata SSRF -> Dataflow cross-tenant pivot
 
 A single Apigee tenant project can be abused to reach the Message Processor metadata server, steal its service account, and pivot into a shared Dataflow analytics pipeline that reads/writes cross-tenant buckets.<sup>[[1]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md
index ab4dcce338..55845ab762 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-app-engine-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - App Engine Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## `App Engine`
 
 For information about App Engine check:
@@ -61,4 +63,3 @@ Modify source code to steal credentials if they are being sent or perform a defa
 - [8] [Package google.appengine.v1](https://cloud.google.com/appengine/docs/admin-api/reference/rpc/google.appengine.v1)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md
index ef8df4e975..8a498f7343 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-artifact-registry-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Artifact Registry Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Artifact Registry
 
 For more information about Artifact Registry check:
@@ -20,4 +22,3 @@ The Post Exploitation and Privesc techniques of Artifact Registry were mixed in:
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-bigtable-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-bigtable-post-exploitation.md
index 01d430afe0..2b11cc4009 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-bigtable-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-bigtable-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Bigtable Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Bigtable
 
 For more information about Bigtable check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md
index bf270101cb..78c2b597e0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-build-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Build Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Build
 
 For more information about Cloud Build check:
@@ -40,4 +42,3 @@ curl -X POST \
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md
index 9046ab3ef9..5b72db6782 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-functions-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Functions Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Functions
 
 Find some information about Cloud Functions in:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md
index 6af13bdad8..6c076029a1 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-run-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Run Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Run
 
 For more information about Cloud Run check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md
index fb226b0ac4..1bc22a57a4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-shell-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Shell Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Shell
 
 For more information about Cloud Shell check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md
index 90191e31b5..8fc973151a 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-cloud-sql-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Cloud SQL Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud SQL
 
 For more information about Cloud SQL check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md
index 3cd416b554..28f397d0e8 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-compute-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Compute Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Compute
 
 For more information about Compute and VPC (Networking) check:
@@ -189,4 +191,3 @@ If you **cannot give access to an external project** to the snapshot or disk, yo
 - [9] [gcloud compute ssh](https://cloud.google.com/sdk/gcloud/reference/compute/ssh)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-dataflow-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-dataflow-post-exploitation.md
index 2cfe6cdc6d..3af5c4e9b8 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-dataflow-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-dataflow-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Dataflow Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Dataflow
 
 For more information about Dataflow check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md
index b830ed9ec6..841f551188 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-filestore-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Filestore Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Filestore
 
 For more information about Filestore check:
@@ -136,4 +138,3 @@ gcloud filestore backups create <back-name> \
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md
index 16996791d5..87749adcc3 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-iam-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - IAM Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## IAM <a href="#service-account-impersonation" id="service-account-impersonation"></a>
 
 You can find further information about IAM in:
@@ -74,4 +76,3 @@ gcloud iam service-accounts undelete "${SA_ID}" --project="${PROJECT}"
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md
index 4fcd9d2504..5f79231e41 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-kms-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - KMS Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## KMS
 
 Find basic information about KMS in:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
index be6a225b37..5f5f70cde0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-logging-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Logging Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 For more information check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md
index 2daf610742..4b72b7e4a2 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-monitoring-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Monitoring Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Monitoring
 
 Fore more information check:
@@ -172,4 +174,3 @@ gcloud alpha monitoring channels update CHANNEL_ID --update-channel-labels=email
 - [11] [Create and manage notification channels by API](https://docs.cloud.google.com/monitoring/alerts/using-channels-api)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
index 7b3fa4ff95..2170d858f6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Pub/Sub Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Pub/Sub
 
 For more information about Pub/Sub check the following page:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md
index 88788d619a..b3b2d86054 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Secretmanager Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Secretmanager
 
 For more information about Secret Manager check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md
index 56b75401f5..651a690be8 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Security Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Security
 
 For more information check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
index 1f150247c3..1a3e824f8f 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Storage Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Storage
 
 For more information about Cloud Storage check this page:
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md
index ff9d66f929..5d033e0145 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Vertex AI Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Vertex AI Agent Engine / Reasoning Engine
 
 This page focuses on **Vertex AI Agent Engine / Reasoning Engine** workloads that run attacker-controlled tools or code inside a Google-managed runtime.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md
index 460d439b3c..01cd22e193 100644
--- a/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md
@@ -1,5 +1,7 @@
 # GCP - Workflows Post Exploitation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Workflow
 
 Basic information:
@@ -20,4 +22,3 @@ The post exploitation techniques are actually the same ones as the ones shared i
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md
index 8dbd1fe554..ac2d9b67a0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md
@@ -1,5 +1,7 @@
 # GCP - Privilege Escalation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Introduction to GCP Privilege Escalation <a href="#introduction-to-gcp-privilege-escalation" id="introduction-to-gcp-privilege-escalation"></a>
 
 GCP, as any other cloud, have some **principals**: users, groups and service accounts, and some **resources** like compute engine, cloud functions…\
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md
index 70b523d396..e189186ab4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-apikeys-privesc.md
@@ -1,5 +1,7 @@
 # GCP - AppEngine Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Engine
 
 For more information about App Engine check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md
index e189869e41..b98ec61acf 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-appengine-privesc.md
@@ -1,5 +1,7 @@
 # GCP - AppEngine Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Engine
 
 For more information about App Engine check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md
index 895b08c235..7d14f07bee 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-artifact-registry-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Artifact Registry Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Artifact Registry
 
 For more information about Artifact Registry check:
@@ -298,4 +300,3 @@ When a system or service installs the package using the virtual repository, the
 - [8] [Using TestPyPI](https://packaging.python.org/en/latest/guides/using-testpypi/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md
index 0f01fca1b1..ec9b0e12a1 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-batch-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Batch Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Batch
 
 Basic information:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md
index c3f9a69d4d..53b14ac767 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigquery-privesc.md
@@ -1,5 +1,7 @@
 # GCP - BigQuery Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## BigQuery
 
 For more information about BigQuery check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigtable-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigtable-privesc.md
index 90549c5ee2..424faecfbe 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigtable-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-bigtable-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Bigtable Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Bigtable
 
 For more information about Bigtable check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-clientauthconfig-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-clientauthconfig-privesc.md
index 3a1dcd5543..4732ab2da6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-clientauthconfig-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-clientauthconfig-privesc.md
@@ -1,5 +1,7 @@
 # GCP - ClientAuthConfig Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ### Create OAuth Brand and Client
 
 [**According to the docs**](https://cloud.google.com/iap/docs/programmatic-oauth-clients), these are the required permissions:<sup>[[1]](#references)</sup>
@@ -31,4 +33,3 @@ gcloud iap oauth-clients create projects/PROJECT_NUMBER/brands/BRAND-ID --displa
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
index 712d8336c8..1427ebb8b0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloud-workstations-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Workstations Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ### Container Breakout via Docker Socket (Container -> VM -> Project)
 
 Cloud Workstations base images configure and run Docker inside the workstation, so this is the main **Docker-in-Docker (DinD)** breakout pattern to investigate. The service places the workstation container on a Compute Engine VM; a configuration that exposes `/var/run/docker.sock` or otherwise grants privileged-container access (the documented default for code editors and applications) creates a container-to-VM escalation path. Docker documents that a socket bind gives a container control of the host daemon, and that a privileged container can obtain a root shell on the host.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md
index 3c82e36f3c..8cd38f8f19 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudbuild-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Cloudbuild Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## cloudbuild
 
 For more information about Cloud Build check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc.md
index 28cb1c73ae..b0d5ee337d 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudfunctions-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Cloudfunctions Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## cloudfunctions
 
 More information about Cloud Functions:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudidentity-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudidentity-privesc.md
index e5bf9178d7..1f78e13f05 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudidentity-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudidentity-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Cloudidentity Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloudidentity
 
 For more information about the cloudidentity service, check this page:
@@ -47,4 +49,3 @@ gcloud identity groups memberships modify-membership-roles --group-email <email>
 - [4] [gcloud identity groups memberships describe | Google Cloud SDK | Google Cloud Documentation](https://docs.cloud.google.com/sdk/gcloud/reference/identity/groups/memberships/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md
index 701837e364..014ef44df2 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudscheduler-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Scheduler Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Scheduler
 
 More information in:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudtasks-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudtasks-privesc.md
index a527642e77..d46ed3b751 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudtasks-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-cloudtasks-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Tasks Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Tasks
 
 ### `cloudtasks.tasks.create`, `iam.serviceAccounts.actAs`
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md
index ce28aae77e..dee0c439d4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-composer-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Composer Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## composer
 
 More info in:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md
index 52b7b5a8d2..d1e3fefe43 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/README.md
@@ -1,5 +1,7 @@
 # GCP - Compute Privesc
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Compute
 
 For more information about Compute and VPC (netowork) in GCP check:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md
index 982adb6c47..84f0cf291d 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-compute-privesc/gcp-add-custom-ssh-metadata.md
@@ -1,5 +1,7 @@
 # GCP - Add Custom SSH Metadata
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Modifying the metadata <a href="#modifying-the-metadata" id="modifying-the-metadata"></a>
 
 Metadata modification on an instance could lead to **significant security risks if an attacker gains the necessary permissions**.
@@ -101,4 +103,3 @@ It's possible to broaden the reach of SSH access to multiple Virtual Machines (V
 - [5] [Best practices for controlling SSH login access | Compute Engine](https://docs.cloud.google.com/compute/docs/connect/ssh-best-practices/login-access)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md
index e1ed001a3a..e8e8dd6004 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Container Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## container
 
 ### `container.clusters.get`
@@ -111,4 +113,3 @@ For more information [**follow this link**](../../kubernetes-security/abusing-ro
 - [13] [Role Based Access Control Good Practices](https://kubernetes.io/docs/concepts/security/rbac-good-practices/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataflow-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataflow-privesc.md
index 032ae50bb0..7a50cbf8b2 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataflow-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataflow-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Dataflow Privilege Escalation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Dataflow
 
 {{#ref}}
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md
index 0423907c97..04db875dfd 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-dataproc-privesc.md
@@ -1,5 +1,7 @@
 # GCP Dataproc Privilege Escalation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Dataproc
 
 {{#ref}}
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md
index 089c5308cc..44ca32f5ec 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-deploymentmaneger-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Deploymentmaneger Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## deploymentmanager
 
 Cloud Deployment Manager reached end of support on March 31, 2026. Treat the following as a legacy technique for existing projects and use a supported deployment technology for new work.<sup>[[6]](#references)</sup>
@@ -37,4 +39,3 @@ Google currently lists `deploymentmanager.deployments.setIamPolicy` under Owner,
 - [9] [Cloud Deployment Manager roles and permissions](https://docs.cloud.google.com/iam/docs/roles-permissions/deploymentmanager)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-firebase-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-firebase-privesc.md
index 1f3494c2ce..9e1f3955dc 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-firebase-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-firebase-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Firebase Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Firebase
 
 ### Unauthenticated access to Firebase Realtime Database
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md
index 41b227d1f7..6c4634fd06 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-iam-privesc.md
@@ -1,5 +1,7 @@
 # GCP - IAM Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## IAM
 
 Find more information about IAM in:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md
index 16e99022e3..50c4bc74a0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-kms-privesc.md
@@ -1,5 +1,7 @@
 # GCP - KMS Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## KMS
 
 Info about KMS:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md
index 09eb7d28b0..dd0808dae7 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-local-privilege-escalation-ssh-pivoting.md
@@ -1,5 +1,7 @@
 # GCP - local privilege escalation ssh pivoting
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 In this scenario, suppose that you **have compromised a non-privileged account** inside a VM in a Compute Engine project.
 
 GCP permissions available through the attached Compute Engine service account may provide paths to **local privilege escalation or SSH access**. The practical result depends on the service account's IAM roles and, for OAuth requests from the VM, its access scopes; both can constrain the API call.<sup>[[1]](#references)[[4]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md
index 4370d7f091..27e9bf2a4a 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-misc-perms-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Generic Permissions Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Generic Interesting Permissions
 
 ### \*.setIamPolicy
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md
index 0de2eb559c..f5ab6f79bd 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-network-docker-escape.md
@@ -1,5 +1,7 @@
 # GCP - Network Docker Escape
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Initial State
 
 The two research reports describing this technique started with root access in a Docker container, host-network access, and the **`CAP_NET_ADMIN`** and **`CAP_NET_RAW`** capabilities. The shared network namespace exposed the host's network traffic from the container.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md
index 08813cc21e..204dea888b 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-orgpolicy-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Orgpolicy Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## orgpolicy
 
 ### `orgpolicy.policy.set`
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md
index 5340133aca..895a0331a7 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-pubsub-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Pubsub Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## PubSub
 
 Get more information in:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md
index d379f09019..4400c458f2 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-resourcemanager-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Resourcemanager Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## resourcemanager
 
 ### `resourcemanager.organizations.setIamPolicy`
@@ -21,4 +23,3 @@ Like in the exploitation of `iam.serviceAccounts.setIamPolicy`, this permission
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md
index ea11966abd..2f4a184038 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-run-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Run Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Run
 
 For more information about Cloud Run check:
@@ -140,4 +142,3 @@ gcloud beta run jobs execute job-name --region <region> --update-env-vars="PYTHO
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md
index 17c72197eb..444c0e36e6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-secretmanager-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Secretmanager Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## secretmanager
 
 For more information about secretmanager:
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md
index f6c7823f0b..f9452b6bbb 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-serviceusage-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Serviceusage Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## serviceusage
 
 The permissions below have historically been useful for creating and recovering API keys.<sup>[[1]](#references)</sup> A standard API key is an encrypted string that identifies an application without a principal; it associates requests with a project for quota and billing, and can be used only with APIs that accept API keys.<sup>[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md
index 3efe1b753b..0bdaf86400 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-sourcerepos-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Sourcerepos Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Source Repositories
 
 > [!NOTE]
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md
index ee7019ed33..930d8c8481 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-storage-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Storage Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage
 
 Basic Information:
@@ -188,4 +190,3 @@ The mentioned attack can be performed in a lot of different ways, all of them st
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-vertex-ai-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-vertex-ai-privesc.md
index 1c6a97ecfe..12e18e248f 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-vertex-ai-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-vertex-ai-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Vertex AI Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Vertex AI
 
 For general Vertex AI concepts and API resources, consult the official documentation and REST reference, then check the enumeration page below.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -708,4 +710,3 @@ Current Workbench notebook execution runs notebook code on Vertex AI custom trai
 - [21] [Prebuilt containers for inference and explanation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/predictions/pre-built-containers)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md
index 9bfe52c0d4..8331c87e26 100644
--- a/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md
+++ b/src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-workflows-privesc.md
@@ -1,5 +1,7 @@
 # GCP - Workflows Privesc
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Workflows
 
 Basic Information:
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/README.md b/src/pentesting-cloud/gcp-security/gcp-services/README.md
index 499757548b..835e4f8005 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/README.md
@@ -1,6 +1,7 @@
 # GCP - Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## References
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md
index 0e5292a2a6..e5ca3f7015 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-ai-platform-enum.md
@@ -1,5 +1,7 @@
 # GCP - AI Platform Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## [AI Platform (legacy)](https://docs.cloud.google.com/vertex-ai/docs/deprecations) <a href="#reviewing-ai-platform-configurations" id="reviewing-ai-platform-configurations"></a>
 
 AI Platform Prediction is retired. Google lists April 7, 2025 as its shutdown date and states that all models, associated metadata, and deployments were deleted after shutdown.<sup>[[1]](#references)</sup>
@@ -43,4 +45,3 @@ The model-level IAM check uses the Vertex AI `models.getIamPolicy` REST method a
 - [9] [Locations for machine learning services](https://docs.cloud.google.com/vertex-ai/docs/general/locations)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md
index 0861d28799..bc9084e025 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-api-keys-enum.md
@@ -1,5 +1,7 @@
 # GCP - API Keys Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 In Google Cloud Platform (GCP), a standard API key is a simple encrypted string used to associate API requests with a project for quota and billing purposes. It **does not authenticate a principal**, so it can only be used with APIs that accept API keys and cannot satisfy IAM checks that require an authenticated caller. Use it for application requests that do not require user context; authorization keys bound to service accounts are a separate key type.<sup>[[1]](#references)</sup>
@@ -47,4 +49,3 @@ gcloud services api-keys list --show-deleted
 - [4] [gcloud services api-keys describe | Google Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/services/api-keys/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md
index 73f1865975..7745d278f6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-app-engine-enum.md
@@ -1,5 +1,7 @@
 # GCP - App Engine Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information <a href="#reviewing-app-engine-configurations" id="reviewing-app-engine-configurations"></a>
 
 Google Cloud Platform's (GCP) App Engine is a managed platform for deploying web applications. Its standard environment runs applications in sandboxed container instances, while the flexible environment runs applications on managed Compute Engine virtual machines and supports custom Docker images.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -139,4 +141,3 @@ The service, version, log, instance, firewall, domain-mapping, and certificate c
 - [18] [App Engine staging bucket deployment log](https://discuss.google.dev/t/deploy-strapi-in-gcloud-app/92530)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md
index c497e5ee23..1a825c6bf6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-artifact-registry-enum.md
@@ -1,5 +1,7 @@
 # GCP - Artifact Registry Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Artifact Registry is a managed service for centrally storing and managing software packages, Docker/OCI images, and build dependencies. It integrates with CI/CD services and Google Cloud runtimes for storing and versioning build outputs, and uses IAM for access control.<sup>[[1]](#references)</sup>
@@ -114,4 +116,3 @@ gcloud artifacts docker images list-vulnerabilities projects/<proj-name>/locatio
 - [16] [gcloud artifacts docker images list](https://cloud.google.com/sdk/gcloud/reference/artifacts/docker/images/list)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md
index a7d6756aca..fbda3f74c7 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-batch-enum.md
@@ -1,5 +1,7 @@
 # GCP - Batch Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Google Cloud Platform (GCP) Batch Service** is a fully managed service for scheduling, queuing, and executing batch-processing workloads on Google Cloud resources. It provisions resources and manages capacity on the user's behalf, supporting workloads such as high-performance computing, machine learning, and data processing at scale, with native integration with other Google Cloud services.<sup>[[1]](#references)</sup> For fault-tolerant jobs, Spot VMs can reduce costs but may be preempted at any time.<sup>[[2]](#references)</sup>
@@ -40,4 +42,3 @@ gcloud batch tasks describe projects/<project-id>/locations/<location>/jobs/<job
 - [4] [View jobs and tasks | Batch](https://docs.cloud.google.com/batch/docs/view-jobs-tasks)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md
index 0b66d3759e..6341ef90e4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigquery-enum.md
@@ -1,5 +1,7 @@
 # GCP - Bigquery Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud BigQuery is a **fully-managed, serverless enterprise data warehouse**, offering capabilities for **analysis over petabytes** of data, thus handling large-scale datasets efficiently.<sup>[[2]](#references)</sup>
@@ -263,4 +265,3 @@ The following payload shapes are context-dependent examples from the case studie
 - [26] [BigQuery SQL Injection Cheat Sheet](https://ozguralp.medium.com/bigquery-sql-injection-cheat-sheet-65ad70e11eac)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md
index 6668f43da4..c02c220ddb 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-bigtable-enum.md
@@ -1,5 +1,7 @@
 # GCP - Bigtable Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Bigtable
 
 Google Cloud Bigtable is a fully managed, scalable NoSQL database for large amounts of single-keyed data with high read and write throughput and low latency. It uses sparse, sorted key-value tables and is commonly used for time-series, IoT, financial, personalization, and operational workloads. [Learn more](https://cloud.google.com/bigtable).<sup>[[1]](#references)[[2]](#references)</sup>
@@ -152,4 +154,3 @@ The commands above follow the current Google Cloud CLI resource syntax; cluster
 - [28] [gcloud bigtable authorized-views describe](https://docs.cloud.google.com/sdk/gcloud/reference/bigtable/authorized-views/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md
index 962528d61e..d701d8a16a 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-build-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Build Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Cloud Build is a managed service that executes builds on Google Cloud. It can import source from repositories or Cloud Storage, execute build steps, and produce artifacts; build triggers automate builds in response to source changes. Cloud Build integrates with repositories such as Cloud Source Repositories, GitHub, Bitbucket, and GitLab.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -201,4 +203,3 @@ done
 - [27] [cloud-console-sample-build](https://github.com/GoogleCloudBuild/cloud-console-sample-build)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md
index 9eb6c2f15d..c267cd1693 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-functions-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Functions Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Functions <a href="#reviewing-cloud-functions" id="reviewing-cloud-functions"></a>
 
 [Google Cloud Functions](https://cloud.google.com/functions/) run single-purpose code in managed runtimes in response to HTTP or Cloud events. The source is built into a container and run as a managed service, so you do not manage the underlying host operating system.<sup>[[2]](#references)</sup> Functions can also use environment variables, which the code can read.
@@ -128,4 +130,3 @@ In the following page, you can check how to **abuse cloud function permissions t
 - [18] [Event providers and destinations | Eventarc Standard](https://docs.cloud.google.com/eventarc/standard/docs/event-providers-targets)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md
index eb6b0fcf45..adf6d1b82d 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-run-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Run Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Run <a href="#reviewing-cloud-run-configurations" id="reviewing-cloud-run-configurations"></a>
 
 Cloud Run is a fully managed application platform for running code, functions, or **containers** on Google's scalable infrastructure.<sup>[[1]](#references)[[3]](#references)</sup>
@@ -132,4 +134,3 @@ In the following page, you can check how to **abuse cloud run permissions to esc
 - [22] [Configure secrets for services](https://docs.cloud.google.com/run/docs/configuring/services/secrets)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md
index dedf8859d0..c482482e62 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-scheduler-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Scheduler Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Scheduler is a fully managed **cron service** that sends scheduled work to a target at a fixed time or regular interval. The scheduler delivers a request or message to the target; it does not execute arbitrary code inside the Scheduler service. Its native target types are HTTP/S endpoints, Pub/Sub topics, and App Engine HTTP/S applications.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -55,4 +57,3 @@ gcloud scheduler jobs describe --location us-central1 <scheduler-name>
 - [7] [Schedule a workflow using Cloud Scheduler | Workflows | Google Cloud Documentation](https://docs.cloud.google.com/workflows/docs/schedule-workflow)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md
index 8dd948e378..42a3eaf46e 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-shell-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Shell Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Shell is a managed, interactive shell environment for Google Cloud. It provides command-line access from the browser and through local `gcloud` workflows, with the Google Cloud CLI and other tools pre-installed. Cloud Shell is free for users with a Google Cloud account.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
@@ -33,4 +35,3 @@ Administrators can disable Cloud Shell for managed Google Workspace and Cloud Id
 - [5] [Authorize with Cloud Shell](https://docs.cloud.google.com/shell/docs/auth)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md
index 375abbe3c0..214863ecfd 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-cloud-sql-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud SQL Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Cloud SQL is a fully managed relational-database service for **MySQL, PostgreSQL, and SQL Server**. It removes much of the underlying provisioning and maintenance work, including hardware provisioning, database setup, patching, and backups.<sup>[[1]](#references)</sup>
@@ -112,4 +114,3 @@ gcloud sql backups describe <backup-name> --instance <instance-name>
 - [20] [gcloud sql backups describe](https://docs.cloud.google.com/sdk/gcloud/reference/sql/backups/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md
index fe400fb234..ed002c7803 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-composer-enum.md
@@ -1,5 +1,7 @@
 # GCP - Composer Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Google Cloud Composer** is a fully managed **workflow orchestration service** built on **Apache Airflow**. It enables you to author, schedule, and monitor pipelines that span across clouds and on-premises data centers. With GCP Composer, you can easily integrate your workflows with other Google Cloud services, facilitating efficient data integration and analysis tasks. This service is designed to simplify the complexity of managing cloud-based data workflows, making it a valuable tool for data engineers and developers handling large-scale data processing tasks.<sup>[[1]](#references)</sup>
@@ -54,4 +56,3 @@ In the following page you can check how to **abuse composer permissions to escal
 - [10] [Create Managed Service for Apache Airflow environments](https://docs.cloud.google.com/composer/docs/composer-3/create-environments)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md
index 8533e8e29f..33a187447e 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/README.md
@@ -1,5 +1,7 @@
 # GCP - Compute Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## GCP VPC & Networking
 
 Learn about how this works in:
@@ -258,4 +260,3 @@ Check the Compute Instances privilege escalation section.
 - [24] [gcloud compute snapshots](https://cloud.google.com/sdk/gcloud/reference/compute/snapshots)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md
index 6f19224f7d..00f1cbcd6f 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md
@@ -1,5 +1,7 @@
 # GCP - Compute Instances
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Compute Engine is an IaaS service that provides self-managed virtual machines, configurable machine types, Linux and Windows images, and durable storage options.<sup>[[1]](#references)</sup>
@@ -121,4 +123,3 @@ https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/
 - [19] [View and query VM metadata](https://docs.cloud.google.com/compute/docs/metadata/querying-metadata)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md
index 30091f1c9b..35de05025a 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-vpc-and-networking.md
@@ -1,5 +1,7 @@
 # GCP - VPC & Networking
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## **GCP Compute Networking in a Nutshell**
 
 A VPC network provides connectivity for Compute Engine virtual machines. VPC networks are global resources, while subnets (also called subnetworks) are regional resources. Network firewall rules are configured at the VPC network level but enforced on individual VM network interfaces.<sup>[[3]](#references)[[4]](#references)</sup>
@@ -95,4 +97,3 @@ For the peering setup task, Google Cloud lists these permissions for a custom ro
 - [11] [Set up and manage VPC Network Peering | Virtual Private Cloud | Google Cloud Documentation](https://docs.cloud.google.com/vpc/docs/using-vpc-peering?hl=en)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md
index b93b32b25b..e317b208b9 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-containers-gke-and-composer-enum.md
@@ -1,5 +1,7 @@
 # GCP - Containers & GKE Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Containers
 
 In GCP containers you can find most of the containers based services GCP offers, here you can see how to enumerate the most common ones:
@@ -160,4 +162,3 @@ Even if the API **doesn't allow to modify resources**, it could be possible to f
 - [21] [Cloudflare Pages, part 3: The return of the secrets](https://blog.assetnote.io/2022/05/06/cloudflare-pages-pt3/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataflow-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataflow-enum.md
index 37a558886e..5fd7b0b589 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataflow-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataflow-enum.md
@@ -1,5 +1,7 @@
 # GCP - Dataflow Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Google Cloud Dataflow** is a fully managed service for **batch and streaming data processing**. It enables organizations to build pipelines that transform and analyze data at scale, integrating with Cloud Storage, BigQuery, Pub/Sub, and Bigtable. Template artifacts and User-Defined Function (UDF) files can be stored in Cloud Storage, while Flex Template container images are stored in Artifact Registry. [Learn more](https://cloud.google.com/dataflow).<sup>[[1]](#references)[[2]](#references)[[7]](#references)</sup>
@@ -88,4 +90,3 @@ gcloud storage ls --recursive gs://<bucket>/
 - [10] [Job builder UI overview](https://docs.cloud.google.com/dataflow/docs/guides/job-builder)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md
index 1ae5aab485..35d81cd9c8 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dataproc-enum.md
@@ -1,5 +1,7 @@
 # GCP -  Dataproc Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Dataproc is a fully managed service for running Apache Spark, Apache Hadoop, Apache Flink, and other big data frameworks. It is primarily used for data processing, querying, machine learning, and stream analytics. Dataproc enables organizations to create clusters for distributed computing with ease, integrating seamlessly with other Google Cloud Platform (GCP) services like Cloud Storage, BigQuery, and Cloud Monitoring.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -56,4 +58,3 @@ gcloud dataproc jobs describe <job-id> --region=<region>
 - [8] [gcloud dataproc jobs describe](https://docs.cloud.google.com/sdk/gcloud/reference/dataproc/jobs/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md
index 0886dae303..d671aa7448 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-dns-enum.md
@@ -1,5 +1,7 @@
 # GCP - DNS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## GCP - Cloud DNS
 
 Cloud DNS is a managed Google Cloud service for publishing DNS zones and records; it supports public zones and private zones authorized for selected VPC networks.<sup>[[1]](#references)</sup>
@@ -38,4 +40,3 @@ gcloud dns policies list
 {{#include ../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md
index 2152c72aa5..a844c8b270 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-filestore-enum.md
@@ -1,5 +1,7 @@
 # GCP - Filestore Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Filestore is a **managed file storage service** tailored for applications in need of both a **filesystem interface and a shared filesystem for data**.<sup>[[1]](#references)</sup> This service excels by offering high-performance file shares, which can be integrated with various GCP services. Its utility shines in scenarios where traditional file system interfaces and semantics are crucial, such as in media processing, content management, and the backup of databases.
@@ -83,4 +85,3 @@ There aren't ways to escalate privileges in GCP directly abusing this service, b
 - [11] [gcloud compute networks peerings list-routes](https://docs.cloud.google.com/sdk/gcloud/reference/compute/networks/peerings/list-routes)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md
index 0ea12c8dee..4feb7ff5f6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.md
@@ -1,5 +1,7 @@
 # GCP - Firebase Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## [Firebase](https://cloud.google.com/sdk/gcloud/reference/firebase/)
 
 The Firebase Realtime Database is a cloud-hosted NoSQL database that stores JSON data and synchronizes it with connected clients in real time. [Learn more](https://firebase.google.com/products/realtime-database/).<sup>[[3]](#references)[[4]](#references)[[17]](#references)</sup>
@@ -96,4 +98,3 @@ An authorized review can use those values to check client-side Remote Config exp
 - [17] [Firebase Realtime Database | Firebase Documentation](https://firebase.google.com/products/realtime-database/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md
index 6c6831f515..019bfcd2cf 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-firestore-enum.md
@@ -1,5 +1,7 @@
 # GCP - Firestore Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## [Cloud Firestore](https://cloud.google.com/sdk/gcloud/reference/firestore/)
 
 Cloud Firestore is a flexible, scalable database from Firebase and Google Cloud for mobile, web, and server development. It synchronizes data across client applications with realtime listeners, supports offline use on mobile and web so applications can remain responsive during high latency or loss of connectivity, and integrates with related Firebase and Google Cloud products such as Cloud Run functions.<sup>[[1]](#references)</sup>
@@ -24,4 +26,3 @@ gcloud firestore export gs://my-source-project-export/export-20190113_2109 --col
 - [6] [gcloud firestore export](https://docs.cloud.google.com/sdk/gcloud/reference/firestore/export)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md
index a5d1a75324..8c7a4b10b4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-iam-and-org-policies-enum.md
@@ -1,5 +1,7 @@
 # GCP - IAM, Principals & Org Policies Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Service Accounts
 
 For an intro about what is a service account check:
@@ -271,4 +273,3 @@ In the following page you can check how to **abuse org policies permissions to e
 - [35] [gcloud resource-manager org-policies list](https://docs.cloud.google.com/sdk/gcloud/reference/resource-manager/org-policies/list)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md
index 5b9fa6f4f3..74aff31fc5 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-kms-enum.md
@@ -1,5 +1,7 @@
 # GCP - KMS Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## KMS
 
 The [**Cloud Key Management Service**](https://cloud.google.com/kms/docs/) lets you create and manage cryptographic keys for Google Cloud services and custom applications. Keys are organized in key rings, and IAM roles can be granted on a key, key ring, project, folder, or organization to control access to the keys and their cryptographic operations.<sup>[[2]](#references)[[12]](#references)</sup>
@@ -111,4 +113,3 @@ The `encrypt` command reads the plaintext input and writes ciphertext to the out
 - [18] [gcloud kms decrypt | Google Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/kms/decrypt)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md
index 672c34eda9..270d426e4a 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-logging-enum.md
@@ -1,5 +1,7 @@
 # GCP - Logging Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 This service allows users to store, search, analyze, monitor, and alert on **log data and events** from GCP.<sup>[[3]](#references)</sup>
@@ -155,4 +157,3 @@ Audit coverage is service-specific: some Google Cloud services document `testIam
 - [14] [Monitored resources and services](https://docs.cloud.google.com/logging/docs/api/v2/resource-list)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md
index b754ed4878..9ec00997ec 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-memorystore-enum.md
@@ -1,5 +1,7 @@
 # GCP - Memorystore Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Memorystore
 
 Memorystore is a fully managed in-memory service that offers sub-millisecond data access, scalability, and high availability.<sup>[[1]](#references)</sup> This page covers the Redis and Memcached instance resources exposed by the [**Redis**](https://cloud.google.com/sdk/gcloud/reference/redis) and [**Memcached**](https://cloud.google.com/sdk/gcloud/reference/memcache) `gcloud` command groups. Google Cloud's current documentation marks Memorystore for Memcached as deprecated.<sup>[[2]](#references)</sup>
@@ -36,4 +38,3 @@ For Redis, the export command writes an RDB backup to a Cloud Storage bucket. Th
 {{#include ../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md
index a42925be79..e0840380df 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-monitoring-enum.md
@@ -1,5 +1,7 @@
 # GCP - Monitoring Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Monitoring offers a suite of tools to **monitor**, troubleshoot, and improve the performance of your cloud resources.<sup>[[2]](#references)</sup> From a security perspective, Cloud Monitoring provides several features that are crucial for maintaining the security and compliance of your cloud environment:
@@ -67,4 +69,3 @@ gcloud alpha monitoring channels describe <channel>
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md
index 9994960b7a..21a2ae8f1e 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-pub-sub.md
@@ -1,5 +1,7 @@
 # GCP - Pub/Sub Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Pub/Sub <a href="#reviewing-cloud-pubsub" id="reviewing-cloud-pubsub"></a>
 
 [Google **Cloud Pub/Sub**](https://cloud.google.com/pubsub/) is an asynchronous messaging service that decouples applications producing messages from applications processing them. Its core components include **topics**, named resources to which publishers send messages, and **subscriptions**, named resources representing a stream of messages from one topic to a subscriber application. A message consists of data and optional attributes.<sup>[[1]](#references)</sup>
@@ -75,4 +77,3 @@ To replay previously acknowledged or older messages, use [**seek**](https://clou
 - [8] [Pub/Sub pricing](https://cloud.google.com/pubsub/pricing)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md
index d70769ec12..47053b1e92 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-secrets-manager-enum.md
@@ -1,5 +1,7 @@
 # GCP - Secrets Manager Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Secret Manager
 
 Google [**Secret Manager**](https://cloud.google.com/solutions/secrets-management/) stores passwords, API keys, certificates, files, and other sensitive data; each secret version can contain up to 64 KiB.<sup>[[1]](#references)[[3]](#references)</sup>
@@ -65,4 +67,3 @@ An attacker with permission to update the secret could attempt to **stop rotatio
 - [11] [gcloud secrets versions access](https://cloud.google.com/sdk/gcloud/reference/secrets/versions/access)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md
index 269439a417..2be1d9f0af 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-security-enum.md
@@ -1,5 +1,7 @@
 # GCP - Security Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Platform (GCP) Security encompasses a **comprehensive suite of tools** and practices designed to ensure the **security** of resources and data within the Google Cloud environment, organized here into four main sections: **Security Command Center, Detections and Controls, Data Protection, and Zero Trust.**
@@ -112,4 +114,3 @@ gcp-secrets-manager-enum.md
 - [16] [BeyondCorp Zero Trust Enterprise Security](https://cloud.google.com/beyondcorp)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md
index f774a9d43a..335b533e25 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-source-repositories-enum.md
@@ -1,5 +1,7 @@
 # GCP - Source Repositories Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 > [!WARNING]
 > Cloud Source Repositories has been unavailable to new customers since June 17, 2024; organizations that used it before that date are not affected by that restriction. Google now marks the service End of Sale and requires users to migrate repositories before the shutdown date, so existing deployments should review the migration guidance.<sup>[[1]](#references)[[2]](#references)</sup>
 
@@ -86,4 +88,3 @@ git add, commit, push...
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md
index c7a4467300..77de900f51 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-spanner-enum.md
@@ -1,5 +1,7 @@
 # GCP - Spanner Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## [Cloud Spanner](https://cloud.google.com/sdk/gcloud/reference/spanner/)
 
 Fully managed relational database with unlimited scale, strong consistency, and up to 99.999% availability.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -46,4 +48,3 @@ gcloud spanner instance-configs describe <name>
 - [14] [gcloud spanner instance-configs describe](https://docs.cloud.google.com/sdk/gcloud/reference/spanner/instance-configs/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md
index 3bcff13947..342ecd68d6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-stackdriver-enum.md
@@ -1,5 +1,7 @@
 # GCP - Stackdriver Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## [Cloud Logging](https://docs.cloud.google.com/logging/docs)
 
 Cloud Logging is Google's managed service for storing, searching, analyzing, monitoring, and alerting on log data and events. It provides log buckets, Logs Explorer, and an API for reading, writing, querying, and routing log entries.<sup>[[3]](#references)</sup>
@@ -57,4 +59,3 @@ gcloud logging buckets list --project=PROJECT_ID
 - [13] [VPC Flow Logs](https://docs.cloud.google.com/vpc/docs/flow-logs)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md
index fd5bf7845f..9fd2610dc4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-storage-enum.md
@@ -1,5 +1,7 @@
 # GCP - Storage Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Storage
 
 Google Cloud Storage is a **scalable, managed object-storage service** that stores data as objects in buckets. Storage classes and bucket locations affect availability, durability, and pricing, while features such as **Object Lifecycle Management, Object Versioning, and access controls** help manage and secure data.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
@@ -184,4 +186,3 @@ In the following page you can check how to **abuse storage permissions to escala
 - [16] [List objects with the XML API](https://cloud.google.com/storage/docs/xml-api/get-bucket-list)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-vertex-ai-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-vertex-ai-enum.md
index 3330f1d3a5..3a908b06a5 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-vertex-ai-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-vertex-ai-enum.md
@@ -1,5 +1,7 @@
 # GCP - Vertex AI Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Vertex AI
 
 [Vertex AI](https://cloud.google.com/vertex-ai) is Google Cloud's **unified machine learning platform** for building, deploying, and managing AI models at scale.<sup>[[1]](#references)</sup> It combines various AI and ML services into a single, integrated platform, enabling data scientists and ML engineers to:
@@ -330,4 +332,3 @@ In the following page, you can check how to **abuse Vertex AI permissions to esc
 - [25] [`gcloud workbench instances describe`](https://docs.cloud.google.com/sdk/gcloud/reference/workbench/instances/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md
index 24baddd011..d304ef09f3 100644
--- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-workflows-enum.md
@@ -1,5 +1,7 @@
 # GCP - Workflows Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 **Google Cloud Platform (GCP) Workflows** is a fully managed orchestration service that executes services in an order you define. A workflow can combine Google Cloud services, Cloud Run services or functions, and HTTP-based APIs.<sup>[[1]](#references)</sup>
@@ -46,4 +48,3 @@ gcloud workflows executions describe projects/<proj-number>/locations/<location>
 - [7] [gcloud workflows executions describe](https://docs.cloud.google.com/sdk/gcloud/reference/workflows/executions/describe)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md
index a8ef4c9ab3..52a9ced812 100644
--- a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/README.md
@@ -1,5 +1,7 @@
 # GCP <--> Workspace Pivoting
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## **From GCP to GWS**
 
 ### **Domain Wide Delegation basics**
@@ -192,4 +194,3 @@ Abusing this **Google Groups privilege-escalation path** may allow escalation to
 - [22] [Choose who can see and join your groups](https://support.google.com/a/users/answer/167427?hl=en-GB)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md
index 41f9a74d67..246eeff7a7 100644
--- a/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-to-workspace-pivoting/gcp-understanding-domain-wide-delegation.md
@@ -1,5 +1,7 @@
 # GCP - Understanding Domain-Wide Delegation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 This post is the introduction of [DeleFriend: Severe design flaw in Domain Wide Delegation could leave Google Workspace vulnerable for takeover](https://www.hunters.security/en/blog/delefriend-a-newly-discovered-design-flaw-in-domain-wide-delegation-could-leave-google-workspace-vulnerable-for-takeover), which can be accessed for more details.<sup>[[4]](#references)</sup>
 
 ## **Understanding Domain-Wide Delegation**
@@ -31,4 +33,3 @@ This is how a GCP Service Account can access Google APIs on behalf of other iden
 - [4] [DeleFriend: Severe design flaw in Domain Wide Delegation could leave Google Workspace vulnerable for takeover](https://www.hunters.security/en/blog/delefriend-a-newly-discovered-design-flaw-in-domain-wide-delegation-could-leave-google-workspace-vulnerable-for-takeover)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md
index 198ec0968a..ad14dc36f4 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/README.md
@@ -1,5 +1,7 @@
 # GCP - Unauthenticated Enum & Access
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Public Assets Discovery
 
 One way to discover public cloud resources that belongs to a company is to scrape their webs looking for them. Tools like [**CloudScraper**](https://github.com/jordanpotti/CloudScraper) will scrape the web and search for **links to public cloud resources** (in this case this tool searches `['amazonaws.com', 'digitaloceanspaces.com', 'windows.net', 'storage.googleapis.com', 'aliyuncs.com']`).<sup>[[1]](#references)[[2]](#references)</sup>
@@ -22,4 +24,3 @@ Note that other cloud resources could be searched for and that sometimes these r
 - [5] [Request endpoints | Cloud Storage](https://docs.cloud.google.com/storage/docs/request-endpoints)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
index f56dcc57d3..7a81a98817 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-api-keys-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - API Keys Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## API Keys
 
 For more information about API Keys check:
@@ -172,4 +174,3 @@ If the endpoint returns another user's phone number, email address, settings, or
 - [6] [gcloud services api-keys lookup | Google Cloud SDK](https://cloud.google.com/sdk/gcloud/reference/services/api-keys/lookup)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md
index 5e08e32711..6cb5fb0661 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-app-engine-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - App Engine Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Engine
 
 For more information about App Engine check:
@@ -28,4 +30,3 @@ You could use tools like the ones indicated in:
 {{#include ../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md
index 14996d30d5..718f9191de 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-artifact-registry-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Artifact Registry Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Artifact Registry
 
 For more information about Artifact Registry check:
@@ -20,4 +22,3 @@ Check the following page:
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md
index 55a9b4dfcf..71b7c37a34 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-build-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Build Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Build
 
 For more information about Cloud Build check:
@@ -44,4 +46,3 @@ Moreover, it's easy to see if some cloudbuild execution needs to be performed wh
 - [3] [Default Cloud Build service account](https://docs.cloud.google.com/build/docs/cloud-build-service-account)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md
index 1444c445af..2410830fe0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-functions-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Functions Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Functions
 
 More information about Cloud Functions can be found in:
@@ -83,4 +85,3 @@ Treat the script's output as a candidate list: `allUsers` represents anyone on t
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md
index ae952d881c..902a754eeb 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-run-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud Run Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud Run
 
 For more information about Cloud Run check:
@@ -63,4 +65,3 @@ done
 - [6] [GitLab Security: find_open_cloudrun.sh](https://gitlab.com/gitlab-com/gl-security/security-operations/redteam/redteam-public/pocs/gcp_misc/-/blob/master/find_open_cloudrun.sh)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md
index 2ff0dd0ebd..11443c0034 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-cloud-sql-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Cloud SQL Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Cloud SQL
 
 For more information about Cloud SQL check:
@@ -27,4 +29,3 @@ An authorized identity with the `cloudsql.users.list` permission can use the Clo
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md
index 8cc98807a1..5193cbdbbe 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-compute-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Compute Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Compute
 
 For more information about Compute and VPC (Networking) check:
@@ -26,4 +28,3 @@ If a GCP instance has a vulnerable exposed service an attacker could abuse it to
 - [2] [Authenticate workloads to Google Cloud APIs using service accounts | Compute Engine](https://docs.cloud.google.com/compute/docs/access/authenticate-workloads)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md
index be0b890e53..c8d5faf3d6 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-iam-principals-and-org-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - IAM, Principals & Org Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Iam & GCP Principals
 
 For more information check:
@@ -116,4 +118,3 @@ ERROR: (gcloud.projects.add-iam-policy-binding) INVALID_ARGUMENT: Principal test
 - [8] [Method: projects.serviceAccounts.get](https://docs.cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/get)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md
index 3b8935d195..003511eda1 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-source-repositories-unauthenticated-enum.md
@@ -1,5 +1,7 @@
 # GCP - Source Repositories Unauthenticated Enum
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Source Repositories
 
 > [!NOTE]
@@ -29,4 +31,3 @@ Cloud Source Repositories can connect to GitHub or Bitbucket repositories and sy
 {{#include ../../../banners/hacktricks-training.md}}
 
 
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md
index 7671a27915..08f7cc2dc0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/README.md
@@ -1,5 +1,7 @@
 # GCP - Storage Unauthenticated Enum
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Storage
 
 For more information about Storage check:
@@ -75,4 +77,3 @@ done
 - [3] [find_open_buckets.sh](https://gitlab.com/gitlab-com/gl-security/security-operations/redteam/redteam-public/pocs/gcp_misc/-/blob/master/find_open_buckets.sh)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md
index 68f32a89c1..925ab49df0 100644
--- a/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md
+++ b/src/pentesting-cloud/gcp-security/gcp-unauthenticated-enum-and-access/gcp-storage-unauthenticated-enum/gcp-public-buckets-privilege-escalation.md
@@ -1,5 +1,7 @@
 # GCP - Public Buckets Privilege Escalation
 
+{{#include ../../../../banners/hacktricks-training.md}}
+
 ## Buckets Privilege Escalation
 
 If a bucket IAM policy grants either `allUsers` or `allAuthenticatedUsers` the **storage.buckets.setIamPolicy** permission, a matching caller can change the policy and grant a broader role. Google documents this permission as the ability to update a bucket IAM policy, and this misconfiguration can expose a bucket to privilege escalation.<sup>[[1]](#references)[[2]](#references)[[4]](#references)</sup>
@@ -37,4 +39,3 @@ If `storage.buckets.delete` is also available, deleting the bucket frees its glo
 - [7] [About Cloud Storage buckets](https://docs.cloud.google.com/storage/docs/buckets)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/README.md b/src/pentesting-cloud/ibm-cloud-pentesting/README.md
index e8f5babc40..fdb8c2e5b5 100644
--- a/src/pentesting-cloud/ibm-cloud-pentesting/README.md
+++ b/src/pentesting-cloud/ibm-cloud-pentesting/README.md
@@ -1,5 +1,7 @@
 # IBM Cloud Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## What is IBM Cloud?
 
 IBM Cloud combines platform as a service (PaaS) and infrastructure as a service (IaaS) and supports public, hybrid, multicloud, and Virtual Private Cloud (VPC) deployments. Its catalog includes compute, storage, networking, containers, application-development, security, database, data, and AI services.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md
index 6e080e2f49..71aea3b613 100644
--- a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md
+++ b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-basic-information.md
@@ -1,5 +1,7 @@
 # IBM - Basic Information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Hierarchy
 
 An IBM Cloud enterprise can contain accounts directly or organize them into nested account groups. Within an account, resource groups organize IAM-managed resources, while access groups organize identities for permission assignment.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -67,4 +69,3 @@ When creating a policy, choose:
 - [5] [IAM access policies for resource-level permissions](https://cloud.ibm.com/docs/iam?topic=iam-iamusermanpol)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md
index b3350d5249..7ab3519ebc 100644
--- a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md
+++ b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-crypto-services.md
@@ -1,5 +1,7 @@
 # IBM - Hyper Protect Crypto Services
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 IBM Cloud Hyper Protect Crypto Services is a dedicated, single-tenant key management and cloud hardware security module (HSM) service. Its Keep Your Own Key (KYOK) model lets customers load the HSM master key and control the resulting key hierarchy; IBM Cloud administrators do not have access to those keys. IBM has deprecated the service: new instances cannot be created after March 28, 2026, and existing premium instances are supported until March 28, 2027.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md
index e3bfb86c13..2dd7bf9c9c 100644
--- a/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md
+++ b/src/pentesting-cloud/ibm-cloud-pentesting/ibm-hyper-protect-virtual-server.md
@@ -1,5 +1,7 @@
 # IBM - Hyper Protect Virtual Server
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 IBM Hyper Protect Virtual Servers (HPVS) use **IBM Secure Execution for Linux** to place each workload in an instance-level secure enclave. IBM documents public-cloud and on-premises distributions; the latter runs on KVM-enabled Linux logical partitions on IBM Z or LinuxONE, while the IBM Cloud distribution runs as a VPC virtual server instance on secure-execution-enabled `s390x` profiles.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/kubernetes-security/README.md b/src/pentesting-cloud/kubernetes-security/README.md
index 9651dc8fed..7388cd0c21 100644
--- a/src/pentesting-cloud/kubernetes-security/README.md
+++ b/src/pentesting-cloud/kubernetes-security/README.md
@@ -1,5 +1,7 @@
 # Kubernetes Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Kubernetes Basics
 
 If you don't know anything about Kubernetes this is a **good start**. Read it to learn about the **architecture, components and basic actions** in Kubernetes:
@@ -82,4 +84,3 @@ kubernetes-pivoting-to-clouds.md
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md
index 1546f29d51..9dd1a97e40 100644
--- a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md
+++ b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/README.md
@@ -1,5 +1,7 @@
 # Abusing Roles/ClusterRoles in Kubernetes
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 Here you can find some potentially dangerous Roles and ClusterRoles configurations.\
 Remember that you can get all the supported resources with `kubectl api-resources`. The techniques below organize risky RBAC permissions and offensive Kubernetes paths for use during an authorized cluster review.<sup>[[2]](#references)[[5]](#references)</sup>
 
@@ -905,4 +907,3 @@ https://github.com/aquasecurity/kube-bench
 - [46] [pid_namespaces(7)](https://man7.org/linux/man-pages/man7/pid_namespaces.7.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md
index 570d741e73..d76bec022e 100644
--- a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md
+++ b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/kubernetes-roles-abuse-lab.md
@@ -1,5 +1,7 @@
 # Kubernetes Roles Abuse Lab
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 You can run these labs just inside **minikube**.
 
 ## Pod Creation -> Escalate to ns SAs
diff --git a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md
index 687a80c2c5..61f76d009f 100644
--- a/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md
+++ b/src/pentesting-cloud/kubernetes-security/abusing-roles-clusterroles-in-kubernetes/pod-escape-privileges.md
@@ -1,5 +1,7 @@
 # Pod Escape Privileges
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Privileged and hostPID
 
 With these privileges you will have **access to the hosts processes** and **enough privileges to enter inside the namespace of one of the host processes**.<sup>[[1]](#references)[[2]](#references)</sup>\
@@ -51,4 +53,3 @@ spec:
 - [3] [Linux kernel security constraints for Pods and containers | Kubernetes](https://kubernetes.io/docs/concepts/security/linux-kernel-security-constraints/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md b/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md
index 1b57f6a466..618b42468e 100644
--- a/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md
+++ b/src/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.md
@@ -1,5 +1,7 @@
 # Attacking Kubernetes from inside a Pod
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## **Pod Breakout**
 
 **If you are lucky enough you may be able to escape from it to the node:**
diff --git a/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md b/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md
index 0c89fc9afd..cd09cd65a4 100644
--- a/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md
+++ b/src/pentesting-cloud/kubernetes-security/exposing-services-in-kubernetes.md
@@ -1,5 +1,7 @@
 # Exposing Services in Kubernetes
 
+{{#include ../../banners/hacktricks-training.md}}
+
 There are **different ways to expose services** in Kubernetes so both **internal** endpoints and **external** endpoints can access them.<sup>[[2]](#references)</sup> This Kubernetes configuration is pretty critical as the administrator could give access to **attackers to services they shouldn't be able to access**.
 
 ### Automatic Enumeration
@@ -291,4 +293,3 @@ Do not check only HTTPRoute. GRPCRoute, TLSRoute, TCPRoute, and UDPRoute can exp
 - [19] [External Application Load Balancer overview](https://cloud.google.com/compute/docs/load-balancing/http/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md b/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md
index bfab55124d..1835d365a6 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-basics.md
@@ -1,5 +1,7 @@
 # Kubernetes Basics
 
+{{#include ../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Jorge**](https://www.linkedin.com/in/jorge-belmonte-a924b616b/) **(read his original post** [**here**](https://sickrov.github.io)**)**<sup>[[1]](#references)</sup>
 
 ## Architecture & Basics
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md b/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md
index bf9bfaad0a..daca7b9760 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-enumeration.md
@@ -1,5 +1,7 @@
 # Kubernetes Enumeration
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Kubernetes Tokens
 
 If you have compromised access to a machine the user may have access to some Kubernetes platform. A token or kubeconfig is usually located in a file named by the **env var `KUBECONFIG`** or **inside `~/.kube`**.<sup>[[5]](#references)</sup>
@@ -984,4 +986,3 @@ ccurl --path-as-is -i -s -k -X $'DELETE' \
 - [42] [Attacking and Defending Kubernetes: Bust-A-Kube – Episode 1](https://www.inguardians.com/attacking-and-defending-kubernetes-bust-a-kube-episode-1/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md b/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md
index 457ba27fb0..38855f1a8d 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-external-secrets-operator.md
@@ -1,5 +1,7 @@
 # External Secret Operator
 
+{{#include ../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Fares**](https://www.linkedin.com/in/fares-siala/)
 
 This page gives some pointers onto how you can achieve to steal secrets from a misconfigured ESO or application which uses ESO to sync its secrets into Kubernetes.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md
index 5d06dcf860..644102e642 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md
@@ -1,5 +1,7 @@
 # Kubernetes Hardening
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Tools to analyse a cluster
 
 ### [Steampipe - Kubernetes Compliance](https://github.com/turbot/steampipe-mod-kubernetes-compliance)
@@ -388,4 +390,3 @@ Kubernetes currently releases approximately three times per year, and its versio
 - [28] [Falco](https://github.com/falcosecurity/falco)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md
index dfd7902b27..a9ed1eb8ef 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-hardening/kubernetes-securitycontext-s.md
@@ -1,5 +1,7 @@
 # Kubernetes SecurityContext(s)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## PodSecurityContext <a href="#podsecuritycontext-v1-core" id="podsecuritycontext-v1-core"></a>
 
 [**From the docs:**](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#podsecuritycontext-v1-core)<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md
index b354e5fc6e..0f575f3f91 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/README.md
@@ -1,5 +1,7 @@
 # Kubernetes Kyverno
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 ## Definition
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md
index dd252c644f..0dfb596ba8 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-kyverno/kubernetes-kyverno-bypass.md
@@ -1,5 +1,7 @@
 # Kubernetes Kyverno bypass
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md b/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md
index 6a9875f621..c7f5974f0a 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-namespace-escalation.md
@@ -1,5 +1,7 @@
 # Kubernetes Namespace Escalation
 
+{{#include ../../banners/hacktricks-training.md}}
+
 In Kubernetes it's pretty common that somehow **you manage to get inside a namespace** (by stealing some user credentials or by compromising a pod). However, usually you will be interested in **escalating to a different namespace as more interesting things can be found there**. Namespaces scope namespaced resources and RBAC bindings determine whether a principal can act in another namespace, so a foothold in one namespace does not imply access to another.<sup>[[1]](#references)[[3]](#references)</sup>
 
 Here are some techniques you can try to escape to a different namespace:
@@ -41,4 +43,3 @@ attacking-kubernetes-from-inside-a-pod.md
 - [7] [Organizing Cluster Access Using kubeconfig Files | Kubernetes](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md b/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md
index 1eee18a279..1d2d263173 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-network-attacks.md
@@ -1,5 +1,7 @@
 # Kubernetes Network Attacks
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Introduction
 
 In Kubernetes, it is observed that a default behavior permits the establishment of connections between **all containers residing on the same node**. This applies irrespective of the namespace distinctions. Such connectivity extends down to **Layer 2** (Ethernet). Consequently, this configuration potentially exposes the system to vulnerabilities. Specifically, it opens up the possibility for a **malicious container** to execute an **ARP spoofing attack** against other containers situated on the same node. During such an attack, the malicious container can deceitfully intercept or modify the network traffic intended for other containers.<sup>[[1]](#references)[[2]](#references)</sup>
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md
index ff93b549a2..9c618d72d5 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/README.md
@@ -1,5 +1,7 @@
 # Kubernetes - OPA Gatekeeper
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 ## Definition
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md
index c3a9b5c311..3bdf92f7d9 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-opa-gatekeeper/kubernetes-opa-gatekeeper-bypass.md
@@ -1,5 +1,7 @@
 # Kubernetes OPA Gatekeeper bypass
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 ## Abusing misconfiguration
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md b/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md
index a317ddb31c..bcc872d294 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-pivoting-to-clouds.md
@@ -1,5 +1,7 @@
 # Kubernetes Pivoting to Clouds
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## GCP
 
 If you are running a k8s cluster inside GCP you will probably want that some application running inside the cluster has some access to GCP. There are 2 common ways of doing that:
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md b/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md
index 19537d7d4e..087a737c92 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-role-based-access-control-rbac.md
@@ -1,5 +1,7 @@
 # Kubernetes Role-Based Access Control(RBAC)
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Role-Based Access Control (RBAC)
 
 Kubernetes has an **authorization module named Role-Based Access Control** ([**RBAC**](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)) that helps to set utilization permissions to the API server.<sup>[[1]](#references)</sup>
diff --git a/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md b/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md
index cbbf1ef9b3..bbad67c64f 100644
--- a/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md
+++ b/src/pentesting-cloud/kubernetes-security/kubernetes-validatingwebhookconfiguration.md
@@ -1,5 +1,7 @@
 # Kubernetes ValidatingWebhookConfiguration
 
+{{#include ../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 ## Definition
diff --git a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md
index 4b46eca8d0..d1c079494c 100644
--- a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md
+++ b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/README.md
@@ -1,5 +1,7 @@
 # Pentesting Kubernetes Services
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 Kubernetes uses several **specific network services** that you might find **exposed to the Internet** or in an **internal network once you have compromised one pod**.
 
 ## Finding exposed pods with OSINT
@@ -272,4 +274,3 @@ An example of how this vulnerability can be exploited involves a remote attacker
 - [22] [Create a Private Azure Kubernetes Service (AKS) Cluster](https://learn.microsoft.com/en-us/azure/aks/private-clusters)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md
index db7b81f4cf..4697f2563f 100644
--- a/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md
+++ b/src/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/kubelet-authentication-and-authorization.md
@@ -1,5 +1,7 @@
 # Kubelet Authentication & Authorization
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Kubelet Authentication <a href="#kubelet-authentication" id="kubelet-authentication"></a>
 
 [**From the docss:**](https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/)
diff --git a/src/pentesting-cloud/openshift-pentesting/README.md b/src/pentesting-cloud/openshift-pentesting/README.md
index bedefe0598..ef5a45318e 100644
--- a/src/pentesting-cloud/openshift-pentesting/README.md
+++ b/src/pentesting-cloud/openshift-pentesting/README.md
@@ -1,5 +1,7 @@
 # OpenShift Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 {{#ref}}
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md b/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md
index 221c87c5db..99bebe64d8 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-basic-information.md
@@ -1,5 +1,7 @@
 # OpenShift - Basic information
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Kubernetes prior basic knowledge
 
 Before working with OpenShift, ensure you are comfortable with the Kubernetes environment. The entire OpenShift chapter assumes you have prior knowledge of Kubernetes.
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md
index ec3828af3b..6ba6888040 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/README.md
@@ -1,5 +1,7 @@
 # OpenShift - Jenkins
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Fares**](https://www.linkedin.com/in/fares-siala/)
 
 This page outlines security-testing paths for a Jenkins deployment that uses Kubernetes or OpenShift build agents.
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md
index 860ff4e594..9927b14765 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-jenkins/openshift-jenkins-build-overrides.md
@@ -1,5 +1,7 @@
 # Jenkins in OpenShift - build pod overrides
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Fares**](https://www.linkedin.com/in/fares-siala/)
 
 ## Kubernetes plugin for Jenkins
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md
index 4e324f5f53..69a42925f4 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/README.md
@@ -1,5 +1,7 @@
 # OpenShift - Privilege Escalation
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Missing Service Account
 
 {{#ref}}
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md
index 5f0d7093a6..515dac8f65 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-missing-service-account.md
@@ -1,5 +1,7 @@
 # OpenShift - Missing Service Account
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Missing Service Account
 
 An OpenShift service account is identified by its project and name as `system:serviceaccount:<project>:<name>`. Roles can be granted to that identity through RBAC bindings, while access to a Security Context Constraint (SCC) can be granted directly or through RBAC.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md
index 89d2e58d53..4789a73f66 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-scc-bypass.md
@@ -1,5 +1,7 @@
 # Openshift - SCC bypass
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 ## Privileged Namespaces
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md
index e90e4f1ec6..dcec217f84 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-privilege-escalation/openshift-tekton.md
@@ -1,5 +1,7 @@
 # OpenShift - Tekton
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Haroun**](https://www.linkedin.com/in/haroun-al-mounayar-571830211)
 
 ### What is Tekton
diff --git a/src/pentesting-cloud/openshift-pentesting/openshift-scc.md b/src/pentesting-cloud/openshift-pentesting/openshift-scc.md
index d028b9e424..aa0ef21100 100644
--- a/src/pentesting-cloud/openshift-pentesting/openshift-scc.md
+++ b/src/pentesting-cloud/openshift-pentesting/openshift-scc.md
@@ -1,5 +1,7 @@
 # Openshift - SCC
 
+{{#include ../../banners/hacktricks-training.md}}
+
 **The original author of this page is** [**Guillaume**](https://www.linkedin.com/in/guillaume-chapela-ab4b9a196)
 
 ## Definition
diff --git a/src/pentesting-cloud/pentesting-cloud-methodology.md b/src/pentesting-cloud/pentesting-cloud-methodology.md
index 7ec1ddbb28..dec61ec92b 100644
--- a/src/pentesting-cloud/pentesting-cloud-methodology.md
+++ b/src/pentesting-cloud/pentesting-cloud-methodology.md
@@ -1,5 +1,7 @@
 # Pentesting Cloud Methodology
 
+{{#include ../banners/hacktricks-training.md}}
+
 <figure><img src="../images/CLOUD-logo-letters.svg" alt=""><figcaption></figcaption></figure>
 
 ## Basic Methodology
diff --git a/src/pentesting-cloud/workspace-security/README.md b/src/pentesting-cloud/workspace-security/README.md
index 54a729bf6c..3394331c6f 100644
--- a/src/pentesting-cloud/workspace-security/README.md
+++ b/src/pentesting-cloud/workspace-security/README.md
@@ -1,5 +1,7 @@
 # GWS - Workspace Pentesting
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Entry Points
 
 ### Google Platforms and OAuth Apps Phishing
@@ -88,4 +90,3 @@ After an account compromise, review recent security events, active sessions, rec
 - [11] [Secure a hacked or compromised Google Account](https://support.google.com/accounts/answer/6294825?hl=en)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md
index 98720e91cc..fa92daf2be 100644
--- a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md
+++ b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/README.md
@@ -1,5 +1,7 @@
 # GWS - Google Platforms Phishing
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Generic Phishing Methodology
 
 {{#ref}}
@@ -252,4 +254,3 @@ Configure app access control according to the tenant's risk tolerance:<sup>[[21]
 - [23] [HTML Service: Restrictions](https://developers.google.com/apps-script/guides/html/restrictions)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md
index 8179fc54b0..6e26a9dea5 100644
--- a/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md
+++ b/src/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts.md
@@ -1,5 +1,7 @@
 # GWS - App Scripts
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## App Scripts
 
 Apps Script projects can be bound to Docs, Sheets, Slides, or Forms files, or created as standalone projects. A bound script's simple `onOpen(e)` trigger runs when a user with edit access opens its container; installable triggers can call services that require authorization and run under the account that created the trigger. Scripts request consent when they first need access to private Google data, and installable triggers can also run on a time-based schedule.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup>
@@ -260,4 +262,3 @@ If someone **shares** a document with you with **Editor** access, you can create
 - [21] [Troubleshooting](https://developers.google.com/apps-script/guides/support/troubleshooting)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-persistence.md b/src/pentesting-cloud/workspace-security/gws-persistence.md
index 51a010bc35..2750aee99e 100644
--- a/src/pentesting-cloud/workspace-security/gws-persistence.md
+++ b/src/pentesting-cloud/workspace-security/gws-persistence.md
@@ -1,5 +1,7 @@
 # GWS - Persistence
 
+{{#include ../../banners/hacktricks-training.md}}
+
 > [!CAUTION]
 > In an authorized assessment, treat account-setting changes as noisy. Depending on the account type and Workspace policy, Google can require reauthentication, delay newly added security factors, or send security alerts; the exact behavior varies by action.<sup>[[6]](#references)</sup>
 
@@ -151,4 +153,3 @@ gws-google-platforms-phishing/gws-app-scripts.md
 - [16] [Make your account more secure](https://support.google.com/accounts/answer/46526?hl=en)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-post-exploitation.md b/src/pentesting-cloud/workspace-security/gws-post-exploitation.md
index 66baaf781e..512cb798e4 100644
--- a/src/pentesting-cloud/workspace-security/gws-post-exploitation.md
+++ b/src/pentesting-cloud/workspace-security/gws-post-exploitation.md
@@ -1,5 +1,7 @@
 # GWS - Post Exploitation
 
+{{#include ../../banners/hacktricks-training.md}}
+
 ## Google Groups Privesc
 
 Google Groups permissions determine who can view conversations and members, post, or manage a group; owners can grant these permissions to all members or the entire organization. A Google group can also be used as a Google Cloud IAM principal, so membership in a privileged group can grant its members the bound roles.<sup>[[3]](#references)[[5]](#references)</sup>
@@ -85,4 +87,3 @@ You can also search recent message delivery records with [**Email Log Search**](
 - [18] [Troubleshoot message delivery with Email Log Search — Google Workspace Help](https://support.google.com/a/answer/7513679?hl=en-GB)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md
index 05cd6a2470..0e73a4ded8 100644
--- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md
+++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/README.md
@@ -1,5 +1,7 @@
 # GWS - Workspace Sync Attacks (GCPW, GCDS, GPS, Directory Sync with AD & EntraID)
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## GCPW - Google Credential Provider for Windows
 
 This is the single sign-on that Google Workspace provides so users can log in to Windows with **their managed Google Account**.<sup>[[1]](#references)</sup> Local Workspace artifacts can include refresh tokens in the registry and Chrome profile data; WinPEAS attempts to decrypt them.<sup>[[2]](#references)</sup> The linked guide also discusses tokens in process memory and **clear-text password** recovery.
@@ -67,4 +69,3 @@ gws-admin-directory-sync.md
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md
index 594b622e0e..637d934816 100644
--- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md
+++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcds-google-cloud-directory-sync.md
@@ -1,5 +1,7 @@
 # GCDS - Google Cloud Directory Sync
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Cloud Directory Sync (GCDS) synchronizes directory data such as users and groups from LDAP or Active Directory into Google Workspace.<sup>[[1]](#references)</sup>
@@ -354,4 +356,3 @@ curl -X POST \
 - [14] [Manage user accounts](https://developers.google.com/workspace/admin/directory/v1/guides/manage-users)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md
index 6b44fc0a10..66e80b0f7e 100644
--- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md
+++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gcpw-google-credential-provider-for-windows.md
@@ -1,5 +1,7 @@
 # GCPW - Google Credential Provider for Windows
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 This is the single sign-on that Google Workspace provides so users can log in to their Windows PCs using **their Workspace credentials**. It also stores credentials and tokens used to access Google Workspace on the PC.<sup>[[3]](#references)[[24]](#references)</sup>
@@ -978,4 +980,3 @@ It was checked that even if the computer doesn't have internet access it's possi
 - [24] [The Chain Reaction: New Methods for Extending Local Breaches in Google Workspace](https://businessinsights.bitdefender.com/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md
index a3c6a92da9..1c7deb8c39 100644
--- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md
+++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gps-google-password-sync.md
@@ -1,5 +1,7 @@
 # GPS - Google Password Sync
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 Google Password Sync synchronizes users' Microsoft Active Directory passwords to their managed Google Workspace or Cloud Identity accounts. It does not change the Active Directory password; when an AD password changes, Password Sync pushes that change to Google.<sup>[[1]](#references)</sup>
@@ -208,4 +210,3 @@ Which is the same one you get if you don't indicate any scope.
 - [17] [Manage roles](https://developers.google.com/workspace/admin/directory/v1/guides/manage-roles)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
diff --git a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md
index b90e0c1e76..2e49a82f09 100644
--- a/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md
+++ b/src/pentesting-cloud/workspace-security/gws-workspace-sync-attacks-gcpw-gcds-gps-directory-sync-with-ad-and-entraid/gws-admin-directory-sync.md
@@ -1,5 +1,7 @@
 # GWS - Admin Directory Sync
 
+{{#include ../../../banners/hacktricks-training.md}}
+
 ## Basic Information
 
 The main difference between Directory Sync and GCDS is that GCDS runs on premises and requires on-premises software, whereas **Directory Sync is cloud-based** and does not require a sync client. Directory Sync is configured from [the Google Admin console](https://admin.google.com/ac/sync/externaldirectories), and Google currently documents it as a public beta.<sup>[[1]](#references)[[2]](#references)</sup>
@@ -70,4 +72,3 @@ Authorized administrators can still inspect Directory Sync reporting and audit i
 - [13] [Set up password recovery for users](https://knowledge.workspace.google.com/admin/users/set-up-password-recovery-for-users)
 
 {{#include ../../../banners/hacktricks-training.md}}
-