Breaching Azure Advanced

Get your lab environment ready, review the support channels, and understand how to approach the OASE certification exam.

Ethical and legal boundaries for the course labs, plus Command & Control setup used throughout the attack chains.

Core Azure and Entra ID concepts: managed identities, delegated vs. application permissions, administrative units, Azure Lighthouse, Policy, and Cloud Shell.

Claim dangling Azure subdomains, deliver phishing payloads via Microsoft Teams, and exploit OAuth consent flows with the ConsentFix attack.

Query the Instance Metadata Service (IMDS) from a compromised VM to extract managed identity tokens and escalate access across the subscription.

Abuse misconfigured Key Vault access policies to retrieve secrets, keys, and certificates stored for other workloads.

Chain Key Vault key access and a Function App to decrypt customer-at-rest data stored inside a CosmosDB instance.

Exploit an over-permissioned Azure Function App to create rogue Entra ID users and establish persistence in the tenant.

Map the tenant attack surface using the Microsoft Graph API: users, groups, roles, service principals, and application registrations.

Exploit Azure Arc-managed servers to achieve remote code execution and pivot from the cloud control plane into on-premises infrastructure.

Push a malicious image to an Azure Container Registry, trigger its deployment in an AKS cluster, and achieve container escape.

Take over an Entra ID joined device to extract cached tokens, certificates, and credentials usable for lateral movement.

Export a Primary Refresh Token (PRT) from a compromised device and abuse Privileged Identity Management (PIM) roles to escalate to Global Admin.

Compromise a self-hosted Azure DevOps pipeline agent to execute arbitrary code and exfiltrate secrets injected into pipeline runs.

Attack Active Directory Federation Services to forge SAML tokens and authenticate as any federated user without their credentials.

Steal Azure access tokens directly from browser memory and session storage to silently impersonate authenticated users.

Forge signed JWT client assertions to authenticate as service principals, bypassing secret-based credential requirements entirely.

Abuse exposed ARM deployment templates and private endpoint misconfigurations to access restricted resources and exfiltrate sensitive data.

Register a new device using an ADFS-issued certificate to obtain a compliant device identity and bypass Conditional Access policies.

Discover and exploit publicly accessible Azure Storage containers to retrieve sensitive data and capture the final lab flag.