SaaS Passwords Are Like Cockroaches

Zero-trust and cloud IAM adoption (Azure AD, Okta) surged with remote work, but Semperis' Sean Deuby argues these strategies still depend on the integrity of on-premises Active Directory.

Microsoft's Password Guidance white paper, drawing on billions of Azure AD logins, advises dropping composition rules and periodic resets, keeping an 8-character minimum, and enforcing risk-based MFA.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.

After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.

Azure AD SCIM provisioning synced user names into a web app without output encoding, giving script injection via the firstName field and a path to steal credentials with an imported JS file.