gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 14:47:17 -07:00
Code Issues Packages Projects Releases Wiki Activity
1,056 Commits 22 Branches 17 Tags
12c586205234e0bd7bb3eb2490c232600a30413f
Commit Graph
655 Commits
Author SHA1 Message Date
SirBroccoliandGitHub 12c5862052 Merge branch 'master' into update_Charting_your_way_in_Helm_template_injection_c4c3d85e188cf37f 2026-07-06 17:23:33 +02:00
Carlos Polop 7c46190697 Add summer discount popup 2026-07-06 14:57:14 +02:00
Carlos Polop 339eaf5aba changes 2026-07-04 13:36:42 +02:00
Carlos Polop fdd3d95668 Add local cloud Kubernetes updates 2026-07-04 00:45:00 +02:00
HackTricks News Bot 37e8c750e6 Add content from: Charting your way in: Helm template injection 2026-06-29 16:00:32 +00:00
SirBroccoliandGitHub 36c997b8f0 Merge pull request #316 from OffsecPierogi/master 
azrte-MahonIsland
 2026-06-26 10:15:37 +02:00
SirBroccoliandGitHub 5490c138ba Merge pull request #312 from HackTricks-wiki/update_What_the_Miasma_Campaign_Reveals_About_the_New_S_9de20d9245b07fa3 
What the Miasma Campaign Reveals About the New Supply Chain ...
 2026-06-25 18:06:10 +02:00
Carlos Polop 1b27af5f46 Move Miasma npm abuse into dedicated page 2026-06-25 18:00:45 +02:00
SirBroccoliandGitHub 4bb7f5d2d7 Merge pull request #311 from HackTricks-wiki/update_The_Global_Namespace_Risk_Universal_Bucket_Hijac_541fed5c68a1451e 
The Global Namespace Risk Universal Bucket Hijacking Techniq...
 2026-06-25 17:56:15 +02:00
Carlos Polop 356e26a346 Move bucket hijacking technique to service pages 2026-06-25 17:54:40 +02:00
OffsecPierogiandGitHub 9153166a1d Update az-automation-accounts-privesc.md 
The 2 following techniques demonstrate how privilege escalation can be done with modules and python packages in Azure involving automation accounts. Original research with screenshots and evidence can be provided upon request.
 2026-06-25 09:44:28 -04:00
Hermes 6bec7f4e0a Add Linux course sponsor images 2026-06-24 16:31:25 +02:00
HackTricks News Bot b3aea588e8 Add content from: What the Miasma Campaign Reveals About the New Supply Chain ... 2026-06-23 14:54:34 +00:00
HackTricks News Bot d10beb1886 Add content from: The Global Namespace Risk: Universal Bucket Hijacking Techni... 2026-06-23 03:02:47 +00:00
SirBroccoliandGitHub db20d27796 Merge pull request #310 from TheToddLuci0/azure_alert_phishing 
azrte-TheToddLuci0
 2026-06-21 15:51:41 +02:00
SirBroccoliandGitHub 6a99acfb6f Merge pull request #306 from HackTricks-wiki/update_Hacking_Google_with_AI_AI-Assisted_Discovery-Doc_f250207268e52efb 
Hacking Google with AI AI-Assisted Discovery-Document Fuzzin...
 2026-06-16 15:37:49 +02:00
SirBroccoliandGitHub a11e2ff62a Merge pull request #304 from HackTricks-wiki/update_Ghost-Sender_-_Universal_Email_Spoofing_against__8fb2d618657690cb 
Ghost-Sender - Universal Email Spoofing against Exchange Onl...
 2026-06-16 15:26:37 +02:00
SirBroccoliandGitHub 7a707977b1 Merge pull request #308 from marcgoam/azrte-marcgoam 
azrte-marcgoam
 2026-06-16 15:20:23 +02:00
Marc Gonzalez AmoresandGitHub f2f340de83 Add applications.myOrganization/allProperties/update privesc technique 
## Summary

Adds a new privilege escalation technique to the EntraID privesc page, covering `microsoft.directory/applications.myOrganization/allProperties/update`.

This permission is not present in any built-in role but commonly appears in custom roles delegated to application teams under the assumption that the `.myOrganization` subtype scopes the action to internal-only apps. Since `allProperties` includes `passwordCredentials` and `keyCredentials`, the permission is functionally equivalent to credential-injection capability against every single-tenant app in the tenant.

## Why this matters

The existing page already documents `applications/credentials/update`. The new section complements it by surfacing the custom-role-scoped variant, which is underdocumented and easy to miss during privileged-role audits, admins filter on built-in privileged roles and miss custom roles carrying this single action.

## Testing

The full attack chain was reproduced end-to-end in an isolated Microsoft 365 Business Premium trial tenant:

      1. Created a custom role with `applications.myOrganization/allProperties/update` as the only action.
      2. Assigned it to a non-privileged victim user.
      3. From the victim's session, ran the documented commands to inject a credential into a target single-tenant app and successfully authenticated as the application via `az login --service-principal`.

## References

  - https://learn.microsoft.com/entra/identity/role-based-access-control/custom-available-permissions
  - https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference
  - https://learn.microsoft.com/graph/api/application-addpassword
 2026-06-12 11:02:33 +02:00
HackTricks News Bot 108413b913 Add content from: Hacking Google with AI: AI-Assisted Discovery-Document Fuzzi... 2026-06-11 16:13:40 +00:00
Fudgedotdotdot 7e4c12b7ff Clarified Microsoft.Web/sites/publishxml/action , Microsoft.Web/sites/basicPublishingCredentialsPolicies/write for functionapps 2026-06-10 14:33:48 +02:00
HackTricks News Bot 94cb3da491 Add content from: Ghost-Sender - Universal Email Spoofing against Exchange Onl... 2026-06-10 03:40:02 +00:00
SirBroccoliandGitHub b81257def6 Merge pull request #301 from HackTricks-wiki/update_Poisoning_Claude_Code__One_GitHub_Issue_to_Break_t_20260602_103342 
Poisoning Claude Code One GitHub Issue to Break the Supply C...
 2026-06-05 16:11:29 +02:00
SirBroccoliandGitHub 680428f929 Merge pull request #299 from HackTricks-wiki/update_Authenticated_RCE_via_Argument_Injection_in_Gogs_R_20260528_154851 
Authenticated RCE via Argument Injection in Gogs Rebase Merg...
 2026-06-05 15:52:53 +02:00
SirBroccoliandGitHub ab22b74079 Merge pull request #298 from cblopez/patch-1 
Added access entry abuse to pivot from AWS to Kubernetes
 2026-06-05 15:51:47 +02:00
SirBroccoliandGitHub 45e53868a6 Merge pull request #297 from HackTricks-wiki/update_Investigating_Suspicious_AI_Workflows_in_Microsoft_20260527_153712 
Investigating Suspicious AI Workflows in Microsoft Entra Age...
 2026-06-05 11:23:54 +02:00
HackTricks News Bot 667a8b921e Add content from: Poisoning Claude Code: One GitHub Issue to Break the Supply ... 2026-06-02 10:37:40 +00:00
HackTricks News Bot 4317b90953 Add content from: Authenticated RCE via Argument Injection in Gogs Rebase Merg... 2026-05-28 15:52:25 +00:00
Christian BarralandGitHub 97af0f5005 Added access entry abuse info 
Added sections on abusing configmap (existing) and access entries (new) for AWS EKS, including commands for creating access entries and associating access policies.
 2026-05-28 09:06:51 +02:00
HackTricks News Bot f6523f3643 Add content from: Investigating Suspicious AI Workflows in Microsoft Entra Age... 2026-05-27 15:41:56 +00:00
Jimmy 769ae53c76 Fix table 2026-05-27 00:26:48 +02:00
SirBroccoliandGitHub 2aea30dad8 Merge pull request #295 from HackTricks-wiki/teamcity-security-section 
Add TeamCity CI/CD pentesting section
 2026-05-26 21:32:53 +02:00
Carlos Polop e9b5f23f8a Add TeamCity CI/CD pentesting section 2026-05-26 21:31:37 +02:00
SirBroccoliandGitHub 23530050c5 Merge pull request #293 from HackTricks-wiki/update_Navigating_Lax_Load_Balancers__When_an_Intersectio_20260525_145126 
Navigating Lax Load Balancers When an Intersection Gets You ...
 2026-05-26 21:11:31 +02:00
SirBroccoliandGitHub af48369ba7 Merge pull request #292 from HackTricks-wiki/update_Paved_With_Intent__ROADtools_and_Nation-State_Tact_20260522_143732 
Paved With Intent ROADtools and Nation-State Tactics in the ...
 2026-05-26 21:09:38 +02:00
SirBroccoliandGitHub ae1056fe51 Merge pull request #290 from HackTricks-wiki/update_Mini_Shai-Hulud__FAQ_on_the_TeamPCP_npm_and_PyPI_s_20260521_195353 
Mini Shai-Hulud FAQ on the TeamPCP npm and PyPI supply-chain...
 2026-05-26 21:04:47 +02:00
SirBroccoliandGitHub b4424204e9 Update README.md 2026-05-26 21:04:31 +02:00
Jacob-Ham 3963a1ef8a Fixed virtual mfa device creation command, add example TOTP tool, add command for getting mfa backed session 2026-05-26 12:54:52 -05:00
Carlos Polop 06a089227c f 2026-05-26 17:55:54 +02:00
HackTricks News Bot aa93024621 Add content from: Navigating Lax Load Balancers: When an Intersection Gets You... 2026-05-25 14:55:45 +00:00
HackTricks News Bot 28650f17b4 Add content from: Paved With Intent: ROADtools and Nation-State Tactics in the... 2026-05-22 14:43:02 +00:00
HackTricks News Bot 5704b992d8 Add content from: Red-Teaming Cloud Infrastructure with Neo 2026-05-22 09:06:12 +00:00
HackTricks News Bot 1484d713ec Add content from: Mini Shai-Hulud: FAQ on the TeamPCP npm and PyPI supply-chai... 2026-05-21 19:57:44 +00:00
Jimmy 51f602b871 a 2026-05-18 17:10:42 +02:00
SirBroccoliandGitHub d13c270d7f Merge pull request #286 from JaimePolop/master 
Add WireServer & GoalState
 2026-05-05 18:18:44 +02:00
Carlos Polop 2fe01e873a Mention WireServer MI selector fallback 2026-05-05 17:50:24 +02:00
Carlos Polop 2a4cc7c428 Document Azure MI token discovery limits 2026-05-05 17:45:43 +02:00
Carlos Polop 406b2549aa Replace brittle managed identity enumeration examples 2026-05-05 16:27:01 +02:00
Carlos Polop 393c6997b1 Clarify Azure WireServer access contexts 2026-05-05 16:16:00 +02:00
SirBroccoliandGitHub 2f2df45366 Update README.md 2026-05-05 15:31:53 +02:00