1.1 KiB
1.1 KiB
- General
Get-AzWebAppGet-AzWebApp | Select EnabledHostNames- Gather information on web applications
- Also extracted with
Get-AzDomainInfoin MicroBurst - \Resources\AppServices.csv
- Function Apps
- Check to see if source code/config files are available
- Service Principal exploitation
- PowerZure
Get-AzureAppOwner- Determine if current user is assigned as the owner of a service principal
Add-AzureSPSecret -ApplicationName customapp -Password myPassword456- Can now authenticate as this service principal with this password and explore its permissions
- Note Tenant/App ID in output
- OPSEC NOTE: Azure AD audit logs will record these events with the activity type of "Update application – Certificates and secrets management".
az login --service-principal --username APP_ID --password myPassword456 --tenant TENANT_ID- Authenticate using Azure CLI as service principal
az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'- Determine role assignment of service principal
- PowerZure