Azure Penetration Testing Specialist

In-person

Intro to Azure

Intro to Azure services

Different ways to interact with Azure

Tenant availability and gathering tenant information

Azure subdomains recon

Enumerating services

User enumeration

Password spraying

Consent phishing

Device Code Phishing

Adversary in the Middle

Bypassing MFA

Understanding conditional access

Bypassing conditional access

Understanding different token types

Where to look for tokens

How can different tokens be used and abused

Understanding Entra ID roles and permissions

Understanding users, groups and service principles

Abusing external collaboration for persistence

Abusing service principles for persistence

Understanding storage types

Storage enumeration

Connecting to containers and blobs

Connecting to storage accounts

Understanding automation accounts

Understanding runbooks

Finding and decoding secrets

Persistence with automation accounts

Abusing disk snapshots

Abusing run commands

Abusing IMDS

Abusing key vault policies

Abusing key vault RBAC

Retrieving secrets from key vaults

Container lifecycle

Registry anonymous access

Registry admin access

Inspecting images