gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 14:47:17 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' of github.com:HackTricks-wiki/hacktricks-cloud

Browse Source
This commit is contained in:
Carlos Polop
2026-07-17 08:06:43 +02:00
parent 6caceba32f 361183c9ae
commit a24b3e2fc3
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/azure-security/az-services/az-sql.md
+2
View File
@@ -21,6 +21,8 @@ Azure SQL consists of four main offerings:
- Private endpoints.
- It’s also possible to restrict connections based on domain names.
- It’s also possible to allow Azure services to access it (like to use the Query editor in the portal or to allow an Azure VM to connect).
- If an SQL Server has *Allow Azure services and resources to access this server* set to "Enabled", Azure will automatically create a hidden firewall rule that allows all network traffic originating from Azure to connect to the SQL Server — including resources from any tenant.
- This means that if you obtain valid SQL credentials, you can connect to the victim Azure SQL Server from an Azure VM inside your own attacker‑controlled tenant. [The MS docs explains this](https://learn.microsoft.com/en-us/azure/azure-sql/database/network-access-controls-overview?view=azuresql#allow-azure-services)
**Authentication Methods:**
src/pentesting-cloud/azure-security/az-services/az-storage.md
+4 -5
View File
@@ -238,7 +238,7 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
### Key Features
- Protocol Support: SFTP works with Blob Storage accounts configured with hierarchical namespace (HNS). This organizes blobs into directories and subdirectories for easier navigation.
- Security: SFTP uses local user identities for authentication and does not integrate with RBAC or ABAC. Each local user can authenticate via:
- Security: SFTP can use local user identities, but it also supports Microsoft Entra ID-based access with Azure RBAC for authorization. This means access can be granted with the usual Blob Storage data-plane roles instead of creating local SFTP users. Local users can authenticate via:
- Azure-generated passwords
- Public-private SSH key pairs
- Granular Permissions: Permissions such as Read, Write, Delete, and List can be assigned to local users for up to 100 containers.
@@ -250,8 +250,8 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
- Supported Encryption: Requires Microsoft Security Development Lifecycle (SDL)-approved cryptographic algorithms (e.g., rsa-sha2-256, ecdsa-sha2-nistp256).
- SFTP Configuration:
- Enable SFTP on the storage account.
- Create local user identities with appropriate permissions.
- Configure home directories for users to define their starting location within the container.
- For local-user access, create local user identities with appropriate permissions.
- For local users, configure home directories to define their starting location within the container.
### Permissions
@@ -491,6 +491,7 @@ az-file-shares.md
- [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)
- [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support)
- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access)
- [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key)
- [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage)
- [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account)
@@ -498,5 +499,3 @@ az-file-shares.md
- [https://learn.microsoft.com/en-us/cli/azure/storage/blob](https://learn.microsoft.com/en-us/cli/azure/storage/blob)
{{#include ../../../banners/hacktricks-training.md}}