Catégorie : Divers

Azure Pentest Toolbox


In this article, I would like to share with you a list of penetration testing tools for your Azure subscription.

Azucar is a multi-threaded plugin-based tool to help assess the security of Azure Cloud environment subscription. By leveraging the Azure API , Azucar automatically gathers a variety of configuration data and analyses all data relating to a particular subscription in order to determine security risks.

PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance and exploitation of Azure, AzureAD, and the associated resources.

MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.

ROADtools is a framework to interact with Azure AD. It currently consists of a library (roadlib) and the ROADrecon Azure AD exploration tool.

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work.

MSOLSpray – A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn’t exist, if a user doesn’t exist, if the account is locked, or if the account is disabled.

BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment. Attackers can use BloodHound to easily identify highly complex attack paths that would otherwise be impossible to quickly identify. Defenders can use BloodHound to identify and eliminate those same attack paths. Both blue and red teams can use BloodHound to easily gain a deeper understanding of privilege relationships in an Active Directory environment.


Application Insights | Instrumentation Key


Application Insights est un service de télémétrie utilisées par de nombreuses applications. Ce service fonctionne avec l’aide d’une instrumentation key qui est utilisé quand vous envoyer des événements à ce service.

Il est intéressant de noter que cette instrumentation key peut-etre accessible à l’ensemble des utilisateurs de votre tenant disposant d’un accès en lecture (Reader) à votre service car elle est stockée comme une propriété de votre objet Application Insight.

Vous pouvez ainsi lister l’ensemble des instrumentations key de votre souscription avec l’aide de la commande suivante:

Get-AzResource -ExpandProperties -ResourceType "microsoft.insights/components" | Select -ExpandProperty Properties | Select Name, InstrumentationKey

Cette commande peut-être utilisée par un pentesteur ou encore un personne malveillante dans sa phase de reconnaissance.


AKS | Windows Nodes


Dans cet article nous allons voir ensemble comment créer un cluster AKS avec un Nodepool Windows. AKS supporte les Windows Nodes Pool depuis Avril 2019 en GA. Mais pour un usage en production, on pourra noter que de nombreuses fonctionnalités de sécurité sont manquantes:

  • Support des AAD Pod Identity
  • Network Policy avec Calico
  • Istio (Service Mesh)
  • Azure Defender for Windows Nodes
# - Creation du cluster AKS
az aks create \
--resource-group akswinmax \
--name akswinmaxime \
--node-count 2 \
--enable-addons monitoring \
--generate-ssh-keys \
--windows-admin-password $PASSWORD_WIN \
--windows-admin-username azureuser \
--vm-set-type VirtualMachineScaleSets \
--network-plugin azure \

# - Creation du NodePool Windows
az aks nodepool add \
--resource-group akswinmax \
--cluster-name akswinmaxime \
--os-type Windows \
--name npwin \
--node-count 1