Lateral Movement in Azure App Services

Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.

Azure Load Testing accepts JMeter JMX and Locust Python files that execute code in its environment, enabling Managed Identity token theft, reverse shells, and Key Vault secret extraction.

Karl Fosaaen shows how Contributor access to Azure Automation Accounts can be abused by modifying runbooks to dump secrets from Key Vaults, enabling attackers to read vault data without Owner rights.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen shows how Azure Contributor rights enable VM command execution as SYSTEM via Invoke-AzureRmVMRunCommand without opening firewall ports, scaling PowerShell across subscription VMs.

Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.