Anonymously Enumerating Azure Services

Karl Fosaaen explores anonymous enumeration of Azure blob storage, explaining container access policies and releasing tooling to find publicly exposed blobs holding configs, backups, and credentials.

Karl Fosaaen starts an Azure Automation series, showing how runbook permissions allow attackers to export RunAs certificates and credentials for maintaining privileged access to Azure subscriptions.

Karl Fosaaen introduces Get-AzurePasswords, a MicroBurst script that automates credential dumping from Azure Key Vaults, App Services configurations, and Automation Accounts via Azure PowerShell.

A walkthrough of MicroBurst's Get-AzPasswords, which harvests credentials from Azure Key Vaults, App Services, Automation Accounts, Storage Accounts, and container registries using Az PowerShell.

Analyzes leftover domain-validation TXT records across a million domains to fingerprint the online service providers a company uses, releasing a PowerShell script to automate the reconnaissance.

Karl Fosaaen shows how Contributor access to Azure Automation Accounts can be abused by modifying runbooks to dump secrets from Key Vaults, enabling attackers to read vault data without Owner rights.