0xSs0rZ
  • Hello World
  • Whoami
  • Interesting Books
  • Pentest
    • CheckLists
    • Recon
      • Tools
      • Information Gathering
      • OSINT
        • Tools
        • Emails
        • Dark Web Exposure
        • Database Leak - Credential stuffing
        • Code Search (Gitlab / Github)
        • Credentials in git repos
        • GitHub - finding vulnerabilities
        • API Leaks
        • Docker
        • Social Media
        • Credentials in YouTube Videos
        • Metadata and Hidden infos
      • Whois
      • Google Dorks
      • Git Dorks
      • Cloud
      • DNS Subdomain Enumeration
      • Virtual Host
      • Fingerprinting / Crawling
      • Host Discovery
    • Protocols
      • Port Scan
      • IDS IPS AV Evasion
      • Common Ports
      • MindMap
      • DNS (53)
      • FTP (21)
      • IMAP POP3 (110, 143, 993, 995)
      • IPMI (623 UDP)
      • Kerberos (88)
      • LDAP (389)
      • MSSQL (1433)
      • MySQL (3306)
      • NFS (2049, 111)
      • Oracle TNS (1521, 1522-1529, 1748)
      • RDP (3389)
      • R-Services (512,513,514)
      • RSYNC (873)
      • SMB (445, 139) / RPC
      • SMTP (25, 465)
      • SNMP (10161, UDP 161)
      • SQLite
      • SSH (22)
      • WinRM (5985, 5986)
      • WMI (135)
    • Brute force
      • Default Credentials
      • Password lists
      • Username lists
      • Kraken - All-in-One Tool
      • Bypass IP Blocking
      • Hydra - Basics
      • Web login
      • FTP Bruteforce
      • O365 Bruteforce
      • POP3 Bruteforce
      • RDP Bruteforce
      • SMB Bruteforce
      • SMTP Bruteforce
      • SSH Bruteforce
      • WinRM Bruteforce
      • VNC Bruteforce
    • Shells
      • Web Shell
      • Bind and Reverse Shell
      • TTY Upgrade
    • File Transfer
      • Upload
      • Download - Exfiltration
      • Encryption
    • Web attacks
      • Methodology & Academy
      • OWASP Top 10
      • Avoid Aggressive Scanning
      • Web Enumeration
      • Fuzzing
      • Bypass 403 / 401
      • Bypass 302
      • Registration Form
      • Email Verification Bypass
      • Email injections
      • Phone Number Injection
      • Login Forms Attacks
        • RCE in Login Page
        • Bypass Authentication
        • Login Brute Force
        • Stay Logged In
        • PHP Type Juggling
      • Bypass Captcha
      • SSO
        • OAuth / Okta Misconfiguration
        • SCIM
        • SAML
      • 2FA / OTP
      • Password Reset
      • SQL Injection
      • NoSQL injection
      • LDAP Injection
      • XSS
      • SSI / ESI Injection
      • CSP Bypass
      • File Inclusion LFI / RFI
      • File Upload Attacks
      • Command Injection
      • Markdown injection
      • XPath Injection
      • HTTP Verb Tampering
      • HTTP Header Exploitation
      • HTTP Request Smuggling
      • Price / Checkout Manipulation Methods
      • Testing Credit Cards
      • Cookies Misconfiguration
      • Basic HTTP Authentification
      • JWT Token
      • IDOR
      • XXE / XSLT
      • SSTI
      • CSTI
      • SSRF
      • CSRF
      • CORS
      • Open Redirection
      • CSPT
      • Relative Path Overwrite, RPO
      • CRLF Injection
      • JSON Attack
      • Prototype Pollution
      • Web Mass Assignment
      • Web Cache
      • Clickjacking
      • Tabnabbing
      • Race Conditons
      • CSV Injection
      • CSS Exfiltration
      • WAF Bypass
      • CMS
      • Django
      • Flask / Werkzeug
      • Tomcat (8080)
      • Tomcat CGI
      • Jetty
      • Nginx
      • IIS
      • Exchange / OWA
      • GitLab
      • Jenkins
      • Splunk
      • Elasticsearch
      • PRTG Network Monitor
      • osTicket
      • ColdFusion
      • Nagios
      • Webmin
      • Slack
      • Moodle
      • Jira
      • Magento
      • Prestashop
      • Docker
      • KeyCloak
      • Jupyter Notebook
    • API
      • OWASP API Top 10
      • Checklist
      • API Discovery / Reco
      • Sensitive Data (API Key, JWT token, etc.) Exposed
      • Postman Usage
      • ZAP Scanner & other scanning methods
      • Swagger UI
      • REST API
      • Improper Asset Management
      • Email Enumeration
      • Authentication Bruteforce
      • JWT Token
      • Insecure UUID
      • Mass Assignment
      • Server Side Parameter Pollution
      • IDOR
      • JSON Injection
      • Path Traversal
      • Rate Limiting
      • GraphQL
      • Tools & Scanners
      • Resources
    • Public Exploit
      • Search for CVE PoC
      • Convert line breaks from DOS to Linux
      • 7 zip
      • Adobe Acrobate Reader
      • Aiohttp
      • Angular
      • AnyDesk
      • Apache Active MQ
      • Apache Camel
      • Apache OFBiz
      • Apache Struts
      • Apache Traffic Control
      • Axis IP Camera
      • Cacti
      • Chamilo elearning
      • Check Point
      • Cisco
      • Citrix
      • Cleo File Transfer
      • Commvault
      • CrushFTP
      • CyberPanel
      • D-Link
      • Denodo Scheduler
      • F5 Big-IP
      • Froxlor
      • Fortinet
      • GeoServer
      • Ghostscript
      • Gitea
      • GLPI
      • Gogs
      • Grafana
      • Invision Community
      • Ivanti
      • Keycloak
      • Laravel
      • Mitel MiCollab
      • MobileIron
      • MOVEit Transfer
      • Navidrome
      • Next.js
      • Node.js
      • Nostromo
      • NVMS 1000
      • OpenNetAdmin
      • Oracle PeopleSoft
      • Oracle Weblogic
      • Palo Alto
      • Pandora
      • PDF.js
      • pfSense
      • PHP
      • phpMyAdmin
      • Prestashop
      • Roundcube
      • rsync
      • Salesforce
      • SAP
      • SolarWinds
      • SonicWall
      • Splunk
      • Spring
      • SQLPad
      • Squid Proxy
      • SuiteCRM
      • Symfony
      • Synology
      • TeamViewer
      • TP Link
      • vBulletin
      • Vite.js
      • VMWare
      • Wazuh
      • Winrar
      • YesWiki
      • Zabbix
      • Zimbra
      • ZoneAlarm AV/Firewall
      • ZoneMinder
    • External Pentest
    • Internal Pentest
      • Tools
      • Methodology & Cheatsheet
      • Basic Windows Commands
      • Network Attacks
      • LLMNR NBT-NS Poisoning
      • ADIDNS Spoofing
      • TimeRoast
      • Users Identification
      • Password Policy
      • Password Spray
      • LDAP Pass Back Attack
      • Reconaissance
        • Bloodhound
        • Enumeration from Windows Host
        • Enumeration from Linux Host
      • Microsoft Office & Outlook
      • Microsoft SharePoint
      • Windows Exploit
      • Print Spooler
      • LOL Bins
      • Security Controls
      • Network Shares
      • RDWA
      • Kerberoast
      • Misconfiguration
      • Pre-Created Computer Accounts
      • Privileged Access
      • ACL
      • Privilege escalation
      • SAM & LSA secrets
      • NTLM Hashes
      • LSASS secrets
      • AD CS
      • DPAPI
      • gMSA
      • dMSA - Windows Server 2025
      • Bypass Powershell Execution Policy
      • Disable / Remove AV Defender and Firewall
      • Kerberos Double Hop Problem
      • SCCM
      • MDT
      • AD FS
      • Trustee and Resource Delegation
      • LAPS
      • DCSync
      • NTDS secrets
      • Domain Password Audit Tools
      • Trusts
      • Persistence
      • Tiering
      • Detection
    • Privilege Escalation
      • Find specific file
      • Linux
        • Tools
        • Linux PrivEsc MindMap
        • Basics Commands
        • Basics - EoP Checklist
        • Environment Enum
        • Services & Internals Enum
        • Writable files / directories
        • /etc/passwd & /etc/shadow
        • Credentials Hunting
        • Path Abuse
        • Wildcard Abuse
        • Escaping Restricted Shells
        • SUID/SGID
        • Sudo Rights Abuse
        • Privileged Groups
        • Capabilities
        • Vulnerable Services
        • Cron Job Abuse
        • Kubernetes
        • Logrotate
        • Miscellaneous Techniques
        • Kernel Exploits
        • Shared Libraries
        • Shared Object Hijacking
        • Python Library Hijacking
        • su bruteforce
        • Hardening Linux
      • Windows
        • Tools
        • Cheatsheet
        • Enumeration
        • Credentials Hunting
        • User Privileges
        • Group Privileges
        • User Account control (UAC)
        • Weak Permissions
        • Kernel / Drivers Exploits
        • Vulnerable Services
        • Token Impersonation
        • Exploit CVE
        • DLL Hijacking
        • Citrix Breakout
        • RDWeb Breakout
        • Interacting with Users
        • Pillaging
        • Miscellaneous Techniques
        • Windows Server
        • Windows Desktop Versions
        • Windows Processes
        • MSI Files
        • NTLM elevation of privilege
        • From Local Admin to NT AUTHORITY\SYSTEM
      • Docker Escape / Breakout
    • Post Exploitation
      • Covering Tracks - Linux
      • Pivot, Tunneling and Port Forwarding
      • Lateral Movement
        • Pass the Hash (PtH)
        • Pass the Ticket (PtT) - Windows
        • Pass the Ticket (PtT) - Linux
        • Fileless Lateral Movement
        • DCOM
      • Gather credentials and more
        • Credentials on Host
        • Password managers, Teamviewer, Outlook, etc.
        • Microsoft Teams Cookies
        • Browser cookies
        • Linux post exploitation
        • Screenshots, clipboard
        • IIS Credentials
        • Azure AD / Entra ID
        • MSOL (Microsoft Online Services) account
        • SCOM credentials
        • Cisco phone system
      • Exfiltration
      • Resources
    • Cracking
      • Hashes
      • Files - Encrypted
      • Blurred image, pdf, etc
    • Thick Client Pentest
    • Wifi Pentest
    • Mobile Pentest
    • Configuration Audit / Hardening
    • Code Analysis
    • Tools
      • Arsenal - Cheatsheet
      • Burp
      • Browser Extensions
      • Evil-WinRM
      • Internal Pentest Tools Pre Compiled
      • Metasploit
      • Mimikatz
      • NetExec - CME
      • PowerView
      • Rubeus
      • SQLMAP
      • Vulnerability Scanners
      • Collaborator, Web Hook, etc.
    • Search Engines
    • Cheatsheets
    • Note Keeping / Reporting / Admin Stuff
  • Cloud
    • Cloud VM
    • Enumeration
    • SSRF / RCE
    • Azure
    • AWS
      • Recon / Initial Access / Enum
      • AWS CLI
      • Pacu
      • IAM
      • VPC - Virtual Private Cloud
      • EC2 - Elastic Compute Cloud
      • Lambda Functions
      • Containers
      • CodeBuild
      • S3 - Simple Storage Service
      • RDS - Relational Database Service
      • DynamoDB
      • EBS - Elastic Block Store
      • AMI
      • SecretsManager
      • Cloudtrail
      • Route 53
      • Cognito
      • SNS - Simple Notification Service
      • Tools
      • Resources
    • GCP
    • Kubernetes
    • Tools
  • Labs
  • Antivirus Evasion - Defender
    • Mindmap
    • Defender Module for PowerShell
    • Static Analysis
    • Dynamic Analysis
    • AMSI Bypass
    • Process Injection
    • Open-Source Software
    • User Access Control (UAC)
    • AppLocker
    • LOLBAS / LOLDrivers / LOLESXi
    • PowerShell ConstrainedLanguage Mode, CLM
    • VBScript
    • Bypass all Powershell security features (AMSI,CLM)
    • Bypass AV Payload / Shells
    • Find Folder Exclusions
    • Resources
  • EDR BYPASS
    • Approches for Evasion
    • Tools
    • Obfuscation
    • EDR Killer
    • BYOVD
    • Spoof Command Line Arguments
    • Blind Spots
    • Living Off Security Tools / LOTTunels
    • Process Hollowing
    • Process Injection - Reverse Shell
    • Payload Creation
    • Shellcode Loader
    • MalDev
    • Malware Testing Lab
    • Resources
  • Red Team
    • OpSec / Anonymity
    • Initial Access
    • Infrastructure (phishing, C2, redirector)
    • C2
    • EDR / AV Bypass
    • Physical Penetration Testing
    • Bypass Bitlocker
    • Resources
  • CTF
    • OSINT
    • Forensic
      • Labs
      • PCAP Analysis - Wireshark
      • DNS
      • Active Directory - GPO
      • Rubber Ducky
      • Memory Analysis
      • Disk Analysis
      • Extract Data / File Carving
      • Metadata
      • BinWalk
      • Audio
      • PNG Images
    • Cryptography
      • Tools
      • GPG
      • RSA
      • ECB / CBC
      • Esoteric Programming Language
      • One Time Pad
      • Baconian Cipher
      • ROT-13 / Caesar
      • Morse Code
      • XOR
      • Substitution
      • Vigenere
    • Steganography
      • Methods
      • Tools
    • Write Up
      • Deadface CTF 2024
      • Intigriti 1337UP Live
      • UMDCTF 2025
Powered by GitBook
On this page
  • Windows server AD vs Azure AD
  • MindMap
  • MSFTRecon
  • Kill Chain
  • OSINT
  • Azure Blob Container
  • Subdomain Enum
  • From on-prem AD
  • Bruteforce O365
  • MFA enabled ?
  • O365 Script
  • M365AdminAccessReviewer
  • Roadrecon
  • Misconfiguration
  • Maester
  • Nuclei Templates
  • Monkey365
  • ScubaGear
  • IAM Privilege Escalation Identification Tool
  • BlueMap
  • AzureRT - A Powershell module implementing various Azure Red Team tactics
  • MicroBurst - A PowerShell Toolkit for Attacking Azure
  • ROADtools
  • APEX
  • PowerZure
  • MicroBurst
  • Interesting Book
  • Resources
  1. Cloud

Azure

Azure Pentesting

PreviousSSRF / RCENextAWS

Last updated 16 days ago

Windows server AD vs Azure AD

Windows Server AD

Azure AD

LDAP

Rest APIs

NTLM

OAuth/SAML

Kerberos

OpenID

OU Tree

Flat Structure

Domains and Forests

Tenants

Trusts

Guests

MindMap

MSFTRecon

Comprehensive enumeration without requiring authentication, helping identify potential security misconfigurations and attack vectors.

Kill Chain

OSINT

Azure Blob Container

Subdomain Enum

PS C:\mcrtp_bootcamp_tools\Microburst> Import-Module .\MicroBurst.psm1

PS C:\mcrtp_bootcamp_tools\Microburst> Invoke-EnumerateAzureSubDomains -Base megabigtech -Verbose

From on-prem AD

Bruteforce O365

MFA enabled ?

O365 Script

M365AdminAccessReviewer

Roadrecon

pipx install roadrecon

Misconfiguration

Maester

Nuclei Templates

Monkey365

ScubaGear

IAM Privilege Escalation Identification Tool

BlueMap

AzureRT - A Powershell module implementing various Azure Red Team tactics

MicroBurst - A PowerShell Toolkit for Attacking Azure

ROADtools

APEX

PowerZure

MicroBurst

Interesting Book

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

Resources

A comprehensive guide to penetration testing cloud services deployed in Microsoft Azure, the popular cloud computing service provider used by numerous companies large and small.

https://aadinternals.com/talks/DEFCON31_Azure%20AD%20OSINT.pdf
Azure AD / Entra ID
O365 Bruteforce
Pentesting Azure Applications: The Definitive Guide to Testing and Securing Deployments
Interesting Books
Azure AD / Entra ID
azure-mindmap/img/preview.png at main · matro7sh/azure-mindmapGitHub
AAD Kill chain
GitHub - tenable/EscalateGPT: An AI-powered tool for discovering privilege escalation opportunities in AWS IAM configurations.GitHub
GitHub - synacktiv/Mindmaps: Azure mindmap for penetration testsGitHub
OSINT
GitHub - Arcanum-Sec/msftreconGitHub
Azure OSINT
Azure Recon to FootholdMedium
Azure Recon to FootholdMedium
Azure Blob Container to Intial AccessMedium
GitHub - NetSPI/MicroBurst: A collection of scripts for assessing Microsoft Azure securityGitHub
GitHub - NetSPI/MicroBurst: A collection of scripts for assessing Microsoft Azure securityGitHub
GitHub - NetSPI/MicroBurst: A collection of scripts for assessing Microsoft Azure securityGitHub
GitHub - dafthack/MFASweep: A tool for checking if MFA is enabled on multiple Microsoft ServicesGitHub
GitHub - admindroid-community/powershell-scripts: Office 365 Reporting PowerShell ScriptsGitHub
Azure Security Tools 01: MaesterMedium
GitHub - yuyudhn/AzSubEnum: Azure Service Subdomain EnumerationGitHub
GitHub - notEricaZelic/M365AdminAccessReviewer: Shows which M365 Objects have Privileged Access and what type (i.e. PIM, Direct, Currently Elevated)GitHub
GitHub - cisagov/ScubaGear: Automation to assess the state of your M365 tenant against CISA's baselinesGitHub
Azure Config Review - Nuclei Templates v10.0.0 🎉ProjectDiscovery Blog
GitHub - silverhack/monkey365: Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews.GitHub
GitHub - dirkjanm/ROADtools: The Azure AD exploration framework.GitHub
GitHub - mgeeky/AzureRT: AzureRT - A Powershell module implementing various Azure Red Team tacticsGitHub
GitHub - SikretaLabs/BlueMap: A Azure Exploitation Toolkit for Red Team & PentestersGitHub
GitHub - LuemmelSec/APEX: Azure Post Exploitation FrameworkGitHub
GitHub - hausec/PowerZure: PowerShell framework to assess Azure securityGitHub
Azure AD introduction for red teamersSynacktiv
Logo
GitHub - Kyuu-Ji/Awesome-Azure-Pentest: A collection of resources, tools and more for penetration testing and securing Microsofts cloud platform Azure.GitHub
Abusing Managed Identities - Hacking The Cloud
Azure PentestingHackTricks Cloud
Logo
5 outils pour réaliser un audit de son tenant Microsoft 365IT-Connect
Logo
GitHub - cr4ck3rj4ck5/Azure-Pentest-Toolkit: This repository contains a framework of curated Azure penetration testing tools that are specifically designed to help you identify and mitigate security vulnerabilities in Azure cloud environments.GitHub
Logo
GitHub - merill/awesome-entra: 😎 Awesome list of all things related to Microsoft EntraGitHub
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo
Logo