Targeting Passwords for Managed and Federated Microsoft Accounts

Karl Fosaaen releases a script for anonymous Azure service enumeration, brute forcing DNS across azurewebsites.net, cloudapp.net, and blob.core.windows.net to map a target's public Azure footprint.

Karl Fosaaen explores anonymous enumeration of Azure blob storage, explaining container access policies and releasing tooling to find publicly exposed blobs holding configs, backups, and credentials.

Releases a PowerShell tool that uses Microsoft's userrealm API to enumerate ADFS federated domains, inspired by the Office365 SAML assertion vulnerability research.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Password spraying trades many passwords on one account for a few common ones across many, evading lockouts and monitoring. The AD Security 101 guide covers risks, detection, and defenses like MFA.

Covers hybrid identity risks—SolarWinds-style attacks pivot from on-prem AD into Azure AD—and recommends MFA plus AD Pass-through Authentication over legacy ADFS to shrink the attack surface.