gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-03-12 21:22:57 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #245 from Jacob-Ham/master

Browse Source 
Added AzCLI command for retrieving static web app secrets
This commit is contained in:
SirBroccoli
2026-01-18 12:44:44 +01:00
committed by GitHub
parent df0aaa9a31 f3d0f7a6c2
commit e8e5deb803
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/pentesting-cloud/azure-security/az-privilege-escalation/az-static-web-apps-privesc.md
View File

@@ -144,12 +144,19 @@ az rest --method put \
### Microsoft.Web/staticSites/listSecrets/action
This permission allows to get the **API key deployment token** for the static app:
This permission allows to get the **API key deployment token** for the static app.
Using az rest:
```bash
az rest --method POST \
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Web/staticSites/<app-name>/listSecrets?api-version=2023-01-01"
```
Using AzCLI:
```bash
az staticwebapp secrets list --name <appname> --resource-group <RG>
```
Then, in order to **update an app using the token** you could run the following command. Note that this command was extracted checking **how to Github Action [https://github.com/Azure/static-web-apps-deploy](https://github.com/Azure/static-web-apps-deploy) works**, as it's the one Azure set by default ot use. So the image and paarements could change in the future.