GITBOOK-598: change request with no subject merged in GitBook

pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md

@@ -68,6 +68,16 @@ Then, gcloud will use the state and code with a some hardcoded `client_id` (`325
 Note that the communication with localhost is in HTTP, so it it's possible to intercept the data to get a refresh token, however this data is valid just 1 time, so this would be useless, it's easier to just read the refresh token from the file.
 {% endhint %}
 
+### OAuth Scopes
+
+Get all the OAuth scopes executing:
+
+{% code overflow="wrap" %}
+```bash
+curl "https://developers.google.com/identity/protocols/oauth2/scopes" | grep -oE 'https://www.googleapis.com/auth/[a-zA-A/\-\._]*' | sort -u
+```
+{% endcode %}
+
 ### Service Accounts
 
 Just like with authenticated users, if you manage to **compromise the private key file** of a service account you will be able to **access it usually as long as you want**.\