Cloud Penetration Testing with Azure - Master Initial Access

Set up a free Microsoft 365 Business Premium lab in Azure for pentesting, learn to extend the trial, manage licenses, and cancel before the two-month window to avoid charges.

Enable multifactor authentication for your admin account with global administration privileges using the Azure portal and Microsoft Entra ID; set up Microsoft Authenticator and test sign-in before starting the course.

Claim a free Azure trial to receive 200$ in credits and 12 months of free services, activate your account in the portal, and manage deactivation until you move to pay-as-you-go.

Set up Entra ID user accounts for pentesting with a PowerShell script, install the Azure AD PowerShell module, configure prerequisites, create users, enforce MFA, and verify in the Azure portal.

Extract the target's domain name from the website or Azure portal to perform the initial reconnaissance in cloud penetration testing, using the primary domain name as the key information.

Begin a hands-on pentest with ide internals to surface information from an outside perspective. Install and import the module, then understand its role in azure services and credential exposure.

Enumerate an organization's domains using get add internet domains and Autodiscover to reveal Microsoft 365 exchange online domains, such as Cisco and Meraki, highlighting potential phishing risks from spoofed domains.

Discover how OpenID authentication tokens can be used to sign into web apps like Office or Outlook, and why tenant region and Azure cloud variations matter.

Microsoft Entra ID, a cloud-based identity and access management service, authenticates and authorizes access to cloud and on-prem resources, including non-Microsoft apps, via Azure Active Directory.

Use AAD internals recon to collect Azure tenant details, SSO status, DNS and mail records, including SPF and DKIM, to identify weaknesses for pentesting.

Explain how Microsoft Entra ID roles and Azure roles grant access across cloud environments, including global administrator, owner, and contributor, and how role scopes differ from management group to resources.

Understand various naming conventions for user and administrative accounts, including dots, letters, and prefixes like ADM-, and learn to replicate a schema for enumeration in a pen test environment.

Examine user enumeration from an outsider, using methods like normal, login, and auto logon, noting stealth risks when single sign-on is off and multi-account checks.

Learn external user enumeration on multiple Azure accounts by preparing a text file of potential names, loading it with get-content, and verifying which accounts exist for initial access.

Explore brute force and password spray as methods to gain account access, and learn how Azure's smart lockout and long passwords protect against such attacks.

Explore password spray, a variation of brute force using a small set of common passwords across many accounts, and why Microsoft estimates it drives a third of organization compromises.

Learn to perform password spray with the Office 365 spray tool, using validations, enumerations, and spraying modules, while managing lockout and smart lockout policies.

Explore a phishing framework to bypass MFA using evil jinx, a man-in-the-middle setup that can capture credentials and tokens for initial access, using open-source, easy-to-setup tools.

Set up the phishing lab by creating a DigitalOcean account with a $200 credit and registering a personal domain to configure DNS with a hosting service like Namecheap.

Deploy a DigitalOcean droplet for an EvilGinx deployment, choose a region and Ubuntu image, select a budget-friendly ssd plan, and configure Namecheap dns with a records for your droplet ip.

Install Evilginx on a cloud droplet, configure prerequisites and dns, clone the repo, set up phishing yaml files, enable tls, and create a lure url for targeting Office 365 login.

Enable per-user MFA by editing properties, setting usage location, and assigning a Microsoft 365 Business Premium license; then verify MFA by logging in and completing mobile device setup.

The lecture demonstrates phishing emails created with ChatGPT that prompt password resets to harvest credentials and tokens, showing attackers bypassing MFA in Azure with EvilGinx and cookie editor extension.

Examine device authorization and how attackers exploit the device code flow, using a malicious client to mislead users into authorizing access on Microsoft sites with a six-character code.

Explore GraphSpy’s phishing workflow that captures access tokens to reach tenant resources like SharePoint, OneDrive, and Outlook, illustrating pentesting potential and token-based access risks.

Learn to install and configure GraphSpy on Linux or Windows, set up Python and pip, run a development server, and manage device codes for initial access in Azure pen testing.

This lecture demonstrates a device code phishing workflow in Azure, showing how an attacker can obtain user tokens and access Microsoft services, files, and calendars.

Explore blob storage hunting fundamentals to identify publicly accessible storages, create a storage account with sensitive data, and leverage pentesting tools to test access.

Understand Azure storage accounts, containers, and blobs, and how misconfigured blob storage can expose sensitive data through publicly accessible https endpoints and precise URL structures.

Create a blob hunting lab by deploying an Azure storage environment with a simple PowerShell script, including a public container in West Europe and demo pentesting files.

Set up the microburst pentesting tool in Azure to hunt for blob storage, after installing prerequisites, cloning the repository, and importing the modules in Visual Studio Code.

Explore how to enumerate Azure blobs, identify storage accounts and containers, and retrieve blob data to assess exposure of sensitive information.

Compare DNS scan Python scripts and Forex Buster for blob hunting, using word lists to probe subdomains. Learn setup across Windows, macOS, and Linux.

Demonstrates a predictable resource location attack in cloud testing with Azure, using FeroxBuster to scan a domain with a word list and reveal a secret file inside a public container.

Translate discovered vulnerabilities into practical mitigation tactics to strengthen client security, focusing on initial access threat protection for cloud environments.

Block brute force sign-ins with smart lockout policies and conditional access by location, then use identity protection, password protection, and Microsoft Sentinel to detect and respond to threats.

Implement password spray prevention with smart lockout policies, custom banned password lists, and Microsoft Sentinel analytics to detect anomalies from failed sign-ins across multiple tenants.

Identify and block phishing with Azure tools, DMARC authentication, and Microsoft Defender for Office 365, while training employees and running phishing simulations to measure resilience.

Explore modern phishing threats like EvilGinx and defend with training, multi-factor authentication, and conditional access policies that enforce token protection and device and location checks for privileged access.

Learn how conditional access policies enforce device compliance with Intune and block sign-ins. Explore token protection and continuous access evaluation that revoke tokens and prevent attackers from initial access.

Demonstrate identity protection in Microsoft Entra id p2, evaluating sign in risk from location, device, and app to enforce conditional access and block high risk access with low false positives.

Guard against device code phishing with conditional access, requiring compliant or Microsoft Entra hybrid joined devices; restrict onboarding to office locations and use KQL queries with Microsoft Sentinel.

Explore how to configure conditional access policies in the Azure portal, including named locations, IP ranges, phishing resistant MFA, device conditions, and policy assignment scopes.

Block public access to storage and use Microsoft Defender for storage to detect blob hunting events, alert unusual access, insider activity, and data exfiltration via activity logs and alerts.