Azure Redteam Cheatsheet

I. Reconnaissance (external) Find the subdomain of the target Using microBurst enum email: II. Reconnaissance (internal) Using RoadTool Using StormSpotter Using Bloodhound, Azurehound III. Initial attack Brute force Illicit Consent Grant attack. Using IV. Lateral movement Check env command, look at IDENTITY_HEADER and IDENTITY_ENDPOINT, dump token by this code: Check Deployments Save deployment template VMContinue reading “Azure Redteam Cheatsheet”