Using a discovered SAS token with read/list permissions, enumerate blobs inside the sensitive-exports container. Which file contains credentials?
During App Service enumeration, you discover that the compromised user can read App Service application settings. Find the hidden flag stored in the application settings.
With access to the Web App’s Managed Identity, you can now query certain Azure Resources. Use this access to uncover the hidden secret left behind during provisioning. What is the secret?
A managed identity has Key Vault Secrets User access to kv-finance-prod. Enumerate secrets and retrieve the hidden flag.
ExcaliburCorp has recently migrated part of its infrastructure to Microsoft Azure. Shortly after the migration, the company suffered a security breach resulting in the exposure of sensitive internal data. Their investigation revealed that the attack originated from a disgruntled developer who has since disappeared. To assess and mitigate further risks, ExcaliburCorp has granted you access to a replica Azure environment with the same permissions the developer had at the time of the incident. Your task is to simulate the attacker’s actions, uncover the full extent of the compromise, and identify vulnerable configurations or services that enabled the breach.
Using the provided Azure login credentials, perform OSINT and reconnaissance to identify the Azure Active Directory/AAD Tenant ID associated with the environment.
You are reviewing Azure Activity Logs after a lab compromise. Which operation indicates that an attacker reset another user’s password through Microsoft Entra ID?
You find a SAS token in a table entity. The token starts with:
?sv=2025-01-05 & ss=b & srt=sco & sp=rl & se=2026-08-01T00:00:00Z
Which permissions does sp=rl grant?
You’ve gained access to the Azure environment, now dig deeper. One of the accessible resources contains a hidden flag.
Using the managed identity principal ID discovered in the previous task, identify which Azure RBAC role is assigned to it.
