OWASP Azure — Offensive Testing Methodology
When to Use
- When performing cloud penetration testing on Azure infrastructure.
- When validating the blast radius of a compromised Azure identity (user or service principal).
- When assessing the security of Azure resources like Key Vault, Storage Accounts, and Virtual Machines.
- When investigating paths for privilege escalation within an Azure subscription.
Key Concepts
| Term | Definition |
|---|---|
| IMDS | Instance Metadata Service, provides identity tokens to Azure VMs |
| Managed Identity | An identity for Azure resources, eliminating the need for hardcoded credentials |
| RBAC | Role-Based Access Control, determines what actions an identity can perform |
| ROADtools | A popular toolkit for Azure Entra ID enumeration and analysis |
Offensive Workflow
Step 1: Identity Discovery
Identify the current context using az account show and az ad signed-in-user show.
Step 2: Privilege Escalation
Search for "Owner" or "User Access Administrator" roles that allow self-elevation.
Step 3: Data Exfiltration
Extract secrets from Key Vault or keys from Storage Accounts:
az keyvault secret list --vault-name <vault>
az storage account keys list -n <account>
Remediation Reference
- Use Managed Identities: Avoid using service principal secrets; use System-Assigned or User-Assigned Managed Identities.
- Enforce Least Privilege: Use custom RBAC roles with specific permissions instead of broad roles like "Contributor".
- Harden Key Vault: Enable firewall and "Purge Protection" on all Key Vaults.