Hi,

In this article, I would like to share with you a list of penetration testing tools for your Azure subscription.

Azucar is a multi-threaded plugin-based tool to help assess the security of Azure Cloud environment subscription. By leveraging the Azure API , Azucar automatically gathers a variety of configuration data and analyses all data relating to a particular subscription in order to determine security risks. https://github.com/nccgroup/azucar

PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance and exploitation of Azure, AzureAD, and the associated resources. https://github.com/hausec/PowerZure

MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use. https://github.com/NetSPI/MicroBurst

ROADtools is a framework to interact with Azure AD. It currently consists of a library (roadlib) and the ROADrecon Azure AD exploration tool. https://github.com/dirkjanm/ROADtools

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. https://github.com/Azure/Stormspotter

MSOLSpray – A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn’t exist, if a user doesn’t exist, if the account is locked, or if the account is disabled. https://github.com/dafthack/MSOLSpray

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment. https://github.com/BloodHoundAD/BloodHound

Maxime.

Hello,

Application Insights est un service de télémétrie utilisées par de nombreuses applications. Ce service fonctionne avec l’aide d’une instrumentation key qui est utilisé quand vous envoyer des événements à ce service.

Il est intéressant de noter que cette instrumentation key peut-etre accessible à l’ensemble des utilisateurs de votre tenant disposant d’un accès en lecture (Reader) à votre service car elle est stockée comme une propriété de votre objet Application Insight.

Vous pouvez ainsi lister l’ensemble des instrumentations key de votre souscription avec l’aide de la commande suivante:

Get-AzResource -ExpandProperties -ResourceType "microsoft.insights/components" | Select -ExpandProperty Properties | Select Name, InstrumentationKey

Cette commande peut-être utilisée par un pentesteur ou encore un personne malveillante dans sa phase de reconnaissance.

Maxime.