Azure Cloud Enumeration & Tools

Azure

can you quickly explain the most important components of Azure are from the POV of a pentester?

1. Azure Active Directory (AD) - This service allows you to manage users and their access to resources within your Azure account. It's important to secure access to your Azure AD resources, as they control who can access other resources within your Azure account.

2. Azure Virtual Machines (VMs) - VMs are a core component of Azure, allowing you to launch virtual servers in the cloud. These servers can be used to host websites, applications, and other resources. It's important to secure access to your VMs and ensure that they are properly configured to prevent unauthorized access.

3. Azure Storage - Azure provides a variety of storage services, including blobs (binary large objects), files, and tables. It's important to properly secure access to your Azure Storage resources and ensure that they are configured with the appropriate access controls.

4. Azure SQL Database - This is a managed database service that makes it easy to set up, operate, and scale a SQL database in the cloud. It's important to secure access to your Azure SQL databases and ensure that they are properly configured to prevent unauthorized access.

5. Azure Virtual Network (VNet) - VNet allows you to create a virtual network in the cloud, where you can launch resources in a logically isolated area. It's important to secure access to your VNet and ensure that it is properly configured to prevent unauthorized access to your resources.

Cheat sheets:

https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md

---

AzureHound

The bloodhound of Azure

https://github.com/BloodHoundAD/AzureHound

---

evilginx2

evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. https://github.com/kgretzky/evilginx2

---

fireprox

Can be well used together with MSOLSpray for bypassing rate limiting or IP bans. https://github.com/ustayready/fireprox

---

MSOLSpray

A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!

https://github.com/dafthack/MSOLSpray

---

ScoutSuite

Multicloud, great start to an assessment

https://github.com/nccgroup/ScoutSuite

---

Tools