Gaining AWS Console Access via API Keys

AWS Signer 2.0 for Burp Suite signs or re-signs AWS API requests with SigV4 as they pass through the proxy, adding a new UI, profile management, and multi-source profile import for pentesters.

Outlines five cloud security challenges—shadow IT, attacker-defender resource asymmetry, catastrophic misconfigurations—and argues purpose-built cloud penetration testing is the way to address them.

Compares cloud penetration testing across AWS and Azure, explaining the shared responsibility model and why platform-specific nuances matter for methodology and cloud security maturity.

Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.

A follow-up to managed identity research showing how to collect Azure OAuth bearer tokens from the portal, CLI, managed identities, Automation RunAs, and Cloud Shell, with new MicroBurst scripts.

Shows how Azure's Custom Script Extension and Run Command let a Virtual Machine Contributor run code as LocalSystem on any VM, even with RDP or SSH closed, enabling footholds and escalation.