# Az - Enumeration Tools

{{#include ../../banners/hacktricks-training.md}}

## Installare PowerShell su Linux

> [!TIP]
> Su Linux dovrai installare PowerShell Core:
```bash
sudo apt-get update
sudo apt-get install -y wget apt-transport-https software-properties-common

# Ubuntu 20.04
wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb

# Update repos
sudo apt-get update
sudo add-apt-repository universe

# Install & start powershell
sudo apt-get install -y powershell
pwsh

# Az cli
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
```
## Installa PowerShell in MacOS

Istruzioni tratte dalla [**documentation**](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.4):

1. Installa `brew` se non è ancora installato:
```bash
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
```
2. Installa l'ultima versione stabile di PowerShell:
```sh
brew install powershell/tap/powershell
```
3. Esegui PowerShell:
```sh
pwsh
```
4. Aggiornamento:
```sh
brew update
brew upgrade powershell
```
## Principali strumenti di enumerazione

### az cli

[**Azure Command-Line Interface (CLI)**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) è uno strumento multipiattaforma scritto in Python per gestire e amministrare (la maggior parte delle) risorse Azure e Entra ID. Si connette ad Azure ed esegue comandi amministrativi tramite la riga di comando o script.

Segui questo link per le [**installation instructions¡**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli#install).

I comandi in Azure CLI sono strutturati secondo lo schema: `az <service> <action> <parameters>`

#### Debug | MitM az cli

Usando il parametro **`--debug`** è possibile vedere tutte le richieste che lo strumento **`az`** sta inviando:
```bash
az account management-group list --output table --debug
```
Per eseguire un **MitM** allo strumento e **controllare manualmente tutte le richieste** che invia puoi fare:

{{#tabs }}
{{#tab name="Bash" }}
```bash
export ADAL_PYTHON_SSL_NO_VERIFY=1
export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1
export HTTPS_PROXY="http://127.0.0.1:8080"
export HTTP_PROXY="http://127.0.0.1:8080"

# If this is not enough
# Download the certificate from Burp and convert it into .pem format
# And export the following env variable
openssl x509 -in ~/Downloads/cacert.der -inform DER -out ~/Downloads/cacert.pem -outform PEM
export REQUESTS_CA_BUNDLE=/Users/user/Downloads/cacert.pem
```
{{#endtab }}

{{#tab name="CMD" }}
```bash
set ADAL_PYTHON_SSL_NO_VERIFY=1
set AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1
set HTTPS_PROXY="http://127.0.0.1:8080"
set HTTP_PROXY="http://127.0.0.1:8080"

# If this is not enough
# Download the certificate from Burp and convert it into .pem format
# And export the following env variable
openssl x509 -in cacert.der -inform DER -out cacert.pem -outform PEM
set REQUESTS_CA_BUNDLE=C:\Users\user\Downloads\cacert.pem
```
{{#endtab }}

{{#tab name="PS" }}
```bash
$env:ADAL_PYTHON_SSL_NO_VERIFY=1
$env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1
$env:HTTPS_PROXY="http://127.0.0.1:8080"
$env:HTTP_PROXY="http://127.0.0.1:8080"
```
{{#endtab }}
{{#endtabs }}

### Az PowerShell

Azure PowerShell è un modulo con cmdlets per gestire le risorse Azure direttamente dalla riga di comando di PowerShell.

Follow this link for the [**installation instructions**](https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell).

I comandi in Azure PowerShell AZ Module sono strutturati come: `<Action>-Az<Service> <parameters>`

#### Debug | MitM Az PowerShell

Usando il parametro **`-Debug`** è possibile vedere tutte le richieste che lo strumento invia:
```bash
Get-AzResourceGroup -Debug
```
Per effettuare un **MitM** sul tool e **controllare manualmente tutte le richieste** che invia, puoi impostare le variabili d'ambiente `HTTPS_PROXY` e `HTTP_PROXY` secondo i [**docs**](https://learn.microsoft.com/en-us/powershell/azure/az-powershell-proxy).

### Microsoft Graph PowerShell

Microsoft Graph PowerShell è un SDK cross-platform che consente l'accesso a tutte le Microsoft Graph APIs, inclusi servizi come SharePoint, Exchange e Outlook, utilizzando un singolo endpoint. Supporta PowerShell 7+, l'autenticazione moderna tramite MSAL, identità esterne e query avanzate. Con un focus sul principio del minimo privilegio, garantisce operazioni sicure e riceve aggiornamenti regolari per adeguarsi alle ultime funzionalità delle Microsoft Graph API.

Segui questo link per le [**installation instructions**](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation).

I comandi in Microsoft Graph PowerShell sono strutturati come: `<Action>-Mg<Service> <parameters>`

#### Debug Microsoft Graph PowerShell

Usando il parametro **`-Debug`** è possibile vedere tutte le richieste che il tool invia:
```bash
Get-MgUser -Debug
```
### ~~**AzureAD Powershell**~~

Il modulo Azure Active Directory (AD), ora **deprecato**, fa parte di Azure PowerShell per la gestione delle risorse Azure AD. Fornisce cmdlet per attività come la gestione di utenti, gruppi e registrazioni di applicazioni in Entra ID.

> [!TIP]
> Questo è sostituito da Microsoft Graph PowerShell

Follow this link for the [**installation instructions**](https://www.powershellgallery.com/packages/AzureAD).


## Strumenti automatizzati per Recon & Compliance

### [turbot azure plugins](https://github.com/orgs/turbot/repositories?q=mod-azure)

Turbot con steampipe e powerpipe permette di raccogliere informazioni da Azure e Entra ID, eseguire controlli di compliance e individuare misconfigurazioni. I moduli Azure attualmente più raccomandati da eseguire sono:

- [https://github.com/turbot/steampipe-mod-azure-compliance](https://github.com/turbot/steampipe-mod-azure-compliance)
- [https://github.com/turbot/steampipe-mod-azure-insights](https://github.com/turbot/steampipe-mod-azure-insights)
- [https://github.com/turbot/steampipe-mod-azuread-insights](https://github.com/turbot/steampipe-mod-azuread-insights)
```bash
# Install
brew install turbot/tap/powerpipe
brew install turbot/tap/steampipe
steampipe plugin install azure
steampipe plugin install azuread

# Config creds via env vars or az cli default creds will be used
export AZURE_ENVIRONMENT="AZUREPUBLICCLOUD"
export AZURE_TENANT_ID="<tenant-id>"
export AZURE_SUBSCRIPTION_ID="<subscription-id>"
export AZURE_CLIENT_ID="<client-id>"
export AZURE_CLIENT_SECRET="<secret>"

# Run steampipe-mod-azure-insights
cd /tmp
mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-azure-insights
steampipe service start
powerpipe server
# Go to http://localhost:9033 in a browser
```
### [Prowler](https://github.com/prowler-cloud/prowler)

Prowler è uno strumento di sicurezza Open Source per eseguire valutazioni delle best practice di sicurezza, audit, incident response, continuous monitoring, hardening e forensics readiness per AWS, Azure, Google Cloud e Kubernetes.

Permette fondamentalmente di eseguire centinaia di controlli su un ambiente Azure per individuare misconfigurazioni di sicurezza e raccogliere i risultati in json (e altri formati di testo) o consultarli sul web.
```bash
# Create a application with Reader role and set the tenant ID, client ID and secret in prowler so it access the app

# Launch web with docker-compose
export DOCKER_DEFAULT_PLATFORM=linux/amd64
curl -LO https://raw.githubusercontent.com/prowler-cloud/prowler/refs/heads/master/docker-compose.yml
curl -LO https://raw.githubusercontent.com/prowler-cloud/prowler/refs/heads/master/.env
## If using an old docker-compose version, change the "env_file" params to: env_file: ".env"
docker compose up -d
# Access the web and configure the access to run a scan from it

# Prowler cli
python3 -m pip install prowler --break-system-packages
docker run --rm toniblyx/prowler:v4-latest azure --list-checks
docker run --rm toniblyx/prowler:v4-latest azure --list-services
docker run --rm toniblyx/prowler:v4-latest azure --list-compliance
docker run --rm -e "AZURE_CLIENT_ID=<client-id>" -e "AZURE_TENANT_ID=<tenant-id>" -e "AZURE_CLIENT_SECRET=<secret>" toniblyx/prowler:v4-latest azure --sp-env-auth
## It also support other authentication types, check: prowler azure --help
```
### [Monkey365](https://github.com/silverhack/monkey365)

Consente di eseguire automaticamente revisioni della configurazione di sicurezza delle Azure subscriptions e di Microsoft Entra ID.

I report HTML vengono memorizzati nella directory `./monkey-reports` all'interno della cartella del repository GitHub.
```bash
git clone https://github.com/silverhack/monkey365
Get-ChildItem -Recurse monkey365 | Unblock-File
cd monkey365
Import-Module ./monkey365
mkdir /tmp/monkey365-scan
cd /tmp/monkey365-scan

Get-Help Invoke-Monkey365
Get-Help Invoke-Monkey365 -Detailed

# Scan with user creds (browser will be run)
Invoke-Monkey365 -TenantId <tenant-id> -Instance Azure -Collect All -ExportTo HTML

# Scan with App creds
$SecureClientSecret = ConvertTo-SecureString "<secret>" -AsPlainText -Force
Invoke-Monkey365 -TenantId <tenant-id> -ClientId <client-id> -ClientSecret $SecureClientSecret -Instance Azure -Collect All -ExportTo HTML
```
### [ScoutSuite](https://github.com/nccgroup/ScoutSuite)

ScoutSuite raccoglie dati di configurazione per l'ispezione manuale e mette in evidenza le aree a rischio. È uno strumento di auditing della sicurezza multi-cloud che consente la valutazione della postura di sicurezza degli ambienti cloud.
```bash
virtualenv -p python3 venv
source venv/bin/activate
pip install scoutsuite
scout --help

# Use --cli flag to use az cli credentials
# Use --user-account to have scout prompt for user credentials
# Use --user-account-browser to launch a browser to login
# Use --service-principal to have scout prompt for app credentials

python scout.py azure --cli
```
### [Azure-MG-Sub-Governance-Reporting](https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting)

È uno script powershell che ti aiuta a **visualizzare tutte le risorse e le autorizzazioni all'interno di un Management Group e del tenant Entra ID** e a trovare misconfigurazioni di sicurezza.

Funziona usando il modulo Az PowerShell, quindi qualsiasi autenticazione supportata da questo tool è supportata dal tool.
```bash
import-module Az
.\AzGovVizParallel.ps1 -ManagementGroupId <management-group-id> [-SubscriptionIdWhitelist <subscription-id>]
```
## Strumenti automatici di Post-Exploitation

### [**ROADRecon**](https://github.com/dirkjanm/ROADtools)

L'enumerazione di ROADRecon fornisce informazioni sulla configurazione di Entra ID, come utenti, gruppi, ruoli, criteri di accesso condizionale...
```bash
cd ROADTools
pipenv shell
# Login with user creds
roadrecon auth -u test@corp.onmicrosoft.com -p "Welcome2022!"
# Login with app creds
roadrecon auth --as-app --client "<client-id>" --password "<secret>" --tenant "<tenant-id>"
roadrecon gather
roadrecon gui
```
### [**AzureHound**](https://github.com/BloodHoundAD/AzureHound)

AzureHound è il collector di BloodHound per Microsoft Entra ID e Azure. È un singolo binario statico Go per Windows/Linux/macOS che comunica direttamente con:
- Microsoft Graph (Entra ID directory, M365) e
- Azure Resource Manager (ARM) control plane (subscriptions, resource groups, compute, storage, key vault, app services, AKS, ecc.)

Caratteristiche principali
- Può essere eseguito da qualsiasi punto su Internet pubblico contro le API del tenant (non è richiesto accesso alla rete interna)
- Produce JSON per l'ingestione in BloodHound CE per visualizzare i percorsi di attacco attraverso identità e risorse cloud
- User-Agent predefinito osservato: azurehound/v2.x.x

Opzioni di autenticazione
- Nome utente + password: -u <upn> -p <password>
- Refresh token: --refresh-token <rt>
- JSON Web Token (access token): --jwt <jwt>
- Segreto del service principal: -a <appId> -s <secret>
- Certificato del service principal: -a <appId> --cert <cert.pem> --key <key.pem> [--keypass <pass>]

Esempi
```bash
# Full tenant collection to file using different auth flows
## User creds
azurehound list -u "<user>@<tenant>" -p "<pass>" -t "<tenant-id|domain>" -o ./output.json

## Use an access token (JWT) from az cli for Graph
JWT=$(az account get-access-token --resource https://graph.microsoft.com -o tsv --query accessToken)
azurehound list --jwt "$JWT" -t "<tenant-id>" -o ./output.json

## Use a refresh token (e.g., from device code flow)
azurehound list --refresh-token "<refresh_token>" -t "<tenant-id>" -o ./output.json

## Service principal secret
azurehound list -a "<client-id>" -s "<secret>" -t "<tenant-id>" -o ./output.json

## Service principal certificate
azurehound list -a "<client-id>" --cert "/path/cert.pem" --key "/path/key.pem" -t "<tenant-id>" -o ./output.json

# Targeted discovery
azurehound list users -t "<tenant-id>" -o users.json
azurehound list groups -t "<tenant-id>" -o groups.json
azurehound list roles -t "<tenant-id>" -o roles.json
azurehound list role-assignments -t "<tenant-id>" -o role-assignments.json

# Azure resources via ARM
azurehound list subscriptions -t "<tenant-id>" -o subs.json
azurehound list resource-groups -t "<tenant-id>" -o rgs.json
azurehound list virtual-machines -t "<tenant-id>" -o vms.json
azurehound list key-vaults -t "<tenant-id>" -o kv.json
azurehound list storage-accounts -t "<tenant-id>" -o sa.json
azurehound list storage-containers -t "<tenant-id>" -o containers.json
azurehound list web-apps -t "<tenant-id>" -o webapps.json
azurehound list function-apps -t "<tenant-id>" -o funcapps.json
```
What gets queried
- Graph endpoints (examples):
- /v1.0/organization, /v1.0/users, /v1.0/groups, /v1.0/roleManagement/directory/roleDefinitions, directoryRoles, owners/members
- ARM endpoints (examples):
- management.azure.com/subscriptions/.../providers/Microsoft.Storage/storageAccounts
- .../Microsoft.KeyVault/vaults, .../Microsoft.Compute/virtualMachines, .../Microsoft.Web/sites, .../Microsoft.ContainerService/managedClusters

Preflight behavior and endpoints
- Each azurehound list <object> typically performs these test calls before enumeration:
1) Identity platform: login.microsoftonline.com
2) Graph: GET https://graph.microsoft.com/v1.0/organization
3) ARM: GET https://management.azure.com/subscriptions?api-version=...
- Cloud environment base URLs differ for Government/China/Germany. See constants/environments.go in the repo.

ARM-heavy objects (less visible in Activity/Resource logs)
- The following list targets predominantly use ARM control plane reads: automation-accounts, container-registries, function-apps, key-vaults, logic-apps, managed-clusters, management-groups, resource-groups, storage-accounts, storage-containers, virtual-machines, vm-scale-sets, web-apps.
- These GET/list operations are typically not written to Activity Logs; data-plane reads (e.g., *.blob.core.windows.net, *.vault.azure.net) are covered by Diagnostic Settings at the resource level.

Comportamento preflight ed endpoint
- Ogni azurehound list <object> tipicamente esegue queste chiamate di test prima dell'enumerazione:
1) Identity platform: login.microsoftonline.com
2) Graph: GET https://graph.microsoft.com/v1.0/organization
3) ARM: GET https://management.azure.com/subscriptions?api-version=...
- Le base URL degli ambienti cloud differiscono per Government/China/Germany. Vedi constants/environments.go nel repo.

Oggetti ARM-heavy (meno visibili nei log Activity/Resource)
- I target elencati seguono prevalentemente letture del control plane ARM: automation-accounts, container-registries, function-apps, key-vaults, logic-apps, managed-clusters, management-groups, resource-groups, storage-accounts, storage-containers, virtual-machines, vm-scale-sets, web-apps.
- Queste operazioni GET/list in genere non vengono scritte negli Activity Logs; le letture del data-plane (es. *.blob.core.windows.net, *.vault.azure.net) sono coperte da Diagnostic Settings a livello di risorsa.

OPSEC and logging notes
- Microsoft Graph Activity Logs are not enabled by default; enable and export to SIEM to gain visibility of Graph calls. Expect the Graph preflight GET /v1.0/organization with UA azurehound/v2.x.x.
- Entra ID non-interactive sign-in logs record the identity platform auth (login.microsoftonline.com) used by AzureHound.
- ARM control-plane read/list operations are not recorded in Activity Logs; many azurehound list operations against resources won’t appear there. Only data-plane logging (via Diagnostic Settings) will capture reads to service endpoints.
- Defender XDR GraphApiAuditEvents (preview) can expose Graph calls and token identifiers but may lack UserAgent and have limited retention.

OPSEC e note sui log
- Microsoft Graph Activity Logs non sono abilitati di default; abilitali ed esportali su un SIEM per ottenere visibilità delle chiamate Graph. Aspettati il preflight Graph GET /v1.0/organization con UA azurehound/v2.x.x.
- I log di sign-in non interattivo di Entra ID registrano l'autenticazione sulla identity platform (login.microsoftonline.com) usata da AzureHound.
- Le operazioni di read/list sul control-plane ARM non vengono registrate negli Activity Logs; molte operazioni azurehound list contro risorse non appariranno lì. Solo il logging del data-plane (tramite Diagnostic Settings) catturerà le letture agli endpoint di servizio.
- Defender XDR GraphApiAuditEvents (preview) può esporre le chiamate Graph e gli identificatori dei token ma potrebbe non includere il UserAgent e avere retention limitata.

Tip: When enumerating for privilege paths, dump users, groups, roles, and role assignments, then ingest in BloodHound and use prebuilt cypher queries to surface Global Administrator/Privileged Role Administrator and transitive escalation via nested groups and RBAC assignments.

Suggerimento: Quando enumeri per percorsi di privilegio, esporta users, groups, roles e role assignments, poi importa in BloodHound e usa query CYPHER preconfezionate per mettere in evidenza Global Administrator/Privileged Role Administrator e l'escalation transitiva tramite gruppi annidati e assegnazioni RBAC.

Launch the BloodHound web with `curl -L https://ghst.ly/getbhce | docker compose -f - up` and import the `output.json` file. Then, in the EXPLORE tab, in the CYPHER section you can see a folder icon that contains pre-built queries.

Avvia la web di BloodHound con `curl -L https://ghst.ly/getbhce | docker compose -f - up` e importa il file `output.json`. Poi, nella scheda EXPLORE, nella sezione CYPHER vedrai un'icona a cartella che contiene query preconfezionate.

### [**MicroBurst**](https://github.com/NetSPI/MicroBurst)

MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.

MicroBurst include funzioni e script che supportano la scoperta dei servizi Azure, l'auditing di configurazioni deboli e azioni post-exploitation come credential dumping. È pensato per essere usato durante penetration tests in cui Azure è in uso.
```bash
Import-Module .\MicroBurst.psm1
Import-Module .\Get-AzureDomainInfo.ps1
Get-AzureDomainInfo -folder MicroBurst -Verbose
```
### [**PowerZure**](https://github.com/hausec/PowerZure)

PowerZure è stato creato per rispondere alla necessità di un framework in grado sia di effettuare ricognizione sia di eseguire lo sfruttamento di Azure, EntraID e delle risorse associate.

Usa il modulo **Az PowerShell**, quindi qualsiasi autenticazione supportata dal modulo è supportata dallo strumento.
```bash
# Login
Import-Module Az
Connect-AzAccount

# Clone and import PowerZure
git clone https://github.com/hausec/PowerZure
cd PowerZure
ipmo ./Powerzure.psd1
Invoke-Powerzure -h # Check all the options

# Info Gathering (read)
Get-AzureCurrentUser # Get current user
Get-AzureTarget # What can you access to
Get-AzureUser -All # Get all users
Get-AzureSQLDB -All # Get all SQL DBs
Get-AzureAppOwner # Owners of apps in Entra
Show-AzureStorageContent -All # List containers, shared and tables
Show-AzureKeyVaultContent -All # List all contents in key vaults


# Operational (write)
Set-AzureUserPassword -Password <password> -Username <username> # Change password
Set-AzureElevatedPrivileges # Get permissions from Global Administrator in EntraID to User Access Administrator in Azure RBAC.
New-AzureBackdoor -Username <username> -Password <password>
Invoke-AzureRunCommand -Command <command> -VMName <vmname>
[...]
```
### [**GraphRunner**](https://github.com/dafthack/GraphRunner/wiki/Invoke%E2%80%90GraphRunner)

GraphRunner è un set di strumenti post-exploitation per interagire con la Microsoft Graph API. Fornisce vari strumenti per eseguire reconnaissance, persistence e pillaging di dati da un account Microsoft Entra ID (Azure AD).
```bash
#A good place to start is to authenticate with the Get-GraphTokens module. This module will launch a device-code login, allowing you to authenticate the session from a browser session. Access and refresh tokens will be written to the global $tokens variable. To use them with other GraphRunner modules use the Tokens flag (Example. Invoke-DumpApps -Tokens $tokens)
Import-Module .\GraphRunner.ps1
Get-GraphTokens

#This module gathers information about the tenant including the primary contact info, directory sync settings, and user settings such as if users have the ability to create apps, create groups, or consent to apps.
Invoke-GraphRecon -Tokens $tokens -PermissionEnum

#A module to dump conditional access policies from a tenant.
Invoke-GraphRecon -Tokens $tokens -PermissionEnum

#A module to dump conditional access policies from a tenant.
Invoke-DumpCAPS -Tokens $tokens -ResolveGuids

#This module helps identify malicious app registrations. It will dump a list of Azure app registrations from the tenant including permission scopes and users that have consented to the apps. Additionally, it will list external apps that are not owned by the current tenant or by Microsoft's main app tenant. This is a good way to find third-party external apps that users may have consented to.
Invoke-DumpApps -Tokens $tokens

#Gather the full list of users from the directory.
Get-AzureADUsers -Tokens $tokens -OutFile users.txt

#Create a list of security groups along with their members.
Get-SecurityGroups -AccessToken $tokens.access_token

#Gets groups that may be able to be modified by the current user
Get-UpdatableGroups -Tokens $tokens

#Finds dynamic groups and displays membership rules
Get-DynamicGroups -Tokens $tokens

#Gets a list of SharePoint site URLs visible to the current user
Get-SharePointSiteURLs -Tokens $tokens

#This module attempts to locate mailboxes in a tenant that have allowed other users to read them. By providing a userlist the module will attempt to access the inbox of each user and display if it was successful. The access token needs to be scoped to Mail.Read.Shared or Mail.ReadWrite.Shared for this to work.
Invoke-GraphOpenInboxFinder -Tokens $tokens -Userlist users.txt

#This module attempts to gather a tenant ID associated with a domain.
Get-TenantID -Domain

#Runs Invoke-GraphRecon, Get-AzureADUsers, Get-SecurityGroups, Invoke-DumpCAPS, Invoke-DumpApps, and then uses the default_detectors.json file to search with Invoke-SearchMailbox, Invoke-SearchSharePointAndOneDrive, and Invoke-SearchTeams.
Invoke-GraphRunner -Tokens $tokens
```
### [Stormspotter](https://github.com/Azure/Stormspotter)

Stormspotter crea un “attack graph” delle risorse in una Azure subscription. Permette a red teams e pentesters di visualizzare la attack surface e le opportunità di pivot all'interno di un tenant, e potenzia i tuoi defenders per orientarsi rapidamente e dare priorità al lavoro di incident response.

**Purtroppo sembra non essere più mantenuto.**
```bash
# Start Backend
cd stormspotter\backend\
pipenv shell
python ssbackend.pyz

# Start Front-end
cd stormspotter\frontend\dist\spa\
quasar.cmd serve -p 9091 --history

# Run Stormcollector
cd stormspotter\stormcollector\
pipenv shell
az login -u test@corp.onmicrosoft.com -p Welcome2022!
python stormspotter\stormcollector\sscollector.pyz cli
# This will generate a .zip file to upload in the frontend (127.0.0.1:9091)
```
## Riferimenti
- [Scoperta del cloud con AzureHound (Unit 42)](https://unit42.paloaltonetworks.com/threat-actor-misuse-of-azurehound/)
- [Repository di AzureHound](https://github.com/SpecterOps/AzureHound)
- [Repository di BloodHound](https://github.com/SpecterOps/BloodHound)
- [AzureHound Community Edition Flags](https://bloodhound.specterops.io/collect-data/ce-collection/azurehound-flags)
- [AzureHound constants/environments.go](https://github.com/SpecterOps/AzureHound/blob/main/constants/environments.go)
- [AzureHound client/storage_accounts.go](https://github.com/SpecterOps/AzureHound/blob/main/client/storage_accounts.go)
- [AzureHound client/roles.go](https://github.com/SpecterOps/AzureHound/blob/main/client/roles.go)

{{#include ../../banners/hacktricks-training.md}}
