Tag Archives: redteam

I. Reconnaissance (external) Update useful tool: https://github.com/nyxgeek/o365recon Find the subdomain of the target Using microBurst enum email: II. Reconnaissance (internal) Using RoadTool Using StormSpotter Using Bloodhound, Azurehound III. Initial attack Brute force Illicit Consent Grant attack. Using IV. Lateral movement Check env command, look at IDENTITY_HEADER and IDENTITY_ENDPOINT, dump token by this code: Check DeploymentsContinue reading “Azure Redteam Cheatsheet”