# Offensive Cloud

> Azure-specific offensive security testing methodology. Covers credential harvesting (IMDS, managed identities), enumeration, privilege escalation, and data exfiltration within Azure subscriptions and Entra ID tenants.

- Skill: `owasp/offensive-cloud` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/offensive-cloud`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/offensive-cloud/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/offensive-cloud

---


# Azure — Offensive Testing Methodology

## When to Use
- When performing cloud penetration testing on Azure infrastructure.
- When validating the blast radius of a compromised Azure identity (user or service principal).
- When assessing the security of Azure resources like Key Vault, Storage Accounts, and Virtual Machines.
- When investigating paths for privilege escalation within an Azure subscription.

## Key Concepts

| Term | Definition |
|------|------------|
| IMDS | Instance Metadata Service, provides identity tokens to Azure VMs |
| Managed Identity | An identity for Azure resources, eliminating the need for hardcoded credentials |
| RBAC | Role-Based Access Control, determines what actions an identity can perform |
| ROADtools | A popular toolkit for Azure Entra ID enumeration and analysis |

## Offensive Workflow

### Step 1: Identity Discovery
Identify the current context using `az account show` and `az ad signed-in-user show`.

### Step 2: Privilege Escalation
Search for "Owner" or "User Access Administrator" roles that allow self-elevation.

### Step 3: Data Exfiltration
Extract secrets from Key Vault or keys from Storage Accounts:
```bash
az keyvault secret list --vault-name <vault>
az storage account keys list -n <account>
```

## Remediation Reference
- **Use Managed Identities**: Avoid using service principal secrets; use System-Assigned or User-Assigned Managed Identities.
- **Enforce Least Privilege**: Use custom RBAC roles with specific permissions instead of broad roles like "Contributor".
- **Harden Key Vault**: Enable firewall and "Purge Protection" on all Key Vaults.