cloud-azurelisted

# Azure / Entra ID attacks ## When it applies Target on Azure and you have some access — SSRF into a VM/App Service with a **Managed Identity**, a leaked service-principal secret/cert, or a foothold. Goal: steal tokens, abuse Entra roles, reach resources. ## Why it works Azure resources authenticate via **Managed Identities** and **service principals**; the IMDS hands out OAuth tokens for them. Entra (Azure AD) roles and app permissions are widely over-assigned, and several (adding credentials to a service principal, role assignment, Owner on a subscription) escalate to control. ## Method 1. **Managed Identity → token** (SSRF or on-box): `GET http://169.254.169.254/metadata/identity/ oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/` with header `Metadata: true` (→ `cloud-imds-ssrf`). Also request tokens for Graph, Key Vault, Storage. 2. **Authenticate & enumerate**: `az login` with the SP or token; enumerate roles/resources; map Entra with **AzureHound** (BloodHound for Azure); ScoutSuite/MicroBurst for misconfig. 3. **Entra / IAM privesc**: add credentials to a service principal you can manage → auth as it; abusive Entra roles (Application/Cloud App Admin, Privileged Role Admin); role assignment (`Microsoft.Authorization/roleAssignments/write`) → grant yourself Owner; consent grants. 4. **Resources & secrets**: Key Vault (token for `vault.azure.net`), Storage blobs (→ storage misconfig), Automation Accounts / runbooks (RCE as th