Preface

Welcome to Penetration Testing Azure for Ethical Hackers. This book will cover a wide variety of techniques and attacks that you can use during a penetration test of an Azure environment. Whether you're a seasoned penetration tester who's looking to get an edge in the cloud space or someone who's just getting into the penetration testing space, this book should have valuable information for you.

We will start the book with an introduction to Azure services and the overall architecture of the platform. This first section will cover common services that are used during penetration tests, and the services that support them. This is where we will set the foundation for the rest of the attacks in the book, as attacks typically make use of the architecture and configuration of these services, in contrast with more traditional protocol and code-related penetration testing attacks.

Then, we will cover how you can create and configure a vulnerable test environment in order to follow the exercises in the book. For those who have experience building and maintaining subscriptions, this may be a refresher chapter, but keep in mind that this initial information will inform the rest of the content in the book.

The middle section of the book will cover the attacks and techniques that you will use during a penetration test. The utility of specific attacks in this section will vary for you, as you may not run into all of the services and configurations that we cover during a normal penetration test. As penetration testers who have been in hundreds of Azure subscriptions, we hopefully will be able to give you a good idea of the core services that companies are using, along with the services that are vulnerable to exploits.

For the attacks sections, we will break down the individual attacks by the level of subscription permissions (Reader, Contributor, and so on) and the available attacks for the individual services with those permissions. Since different permissions will allow for different attacks, we'll start with the more basic read-only attacks and move toward more advanced (greater permissions) attacks.

The final chapter of the book focuses on persistence in an Azure environment. During a penetration test, you may find yourself in a situation where you need to maintain access to certain sections of an Azure environment. We will review multiple techniques to hide in an Azure environment.

Thank you for purchasing Penetration Testing Azure for Ethical Hackers!

Hack responsibly and good luck!