Penetration Testing on Azure

In the cyber world, securing the cloud is critical to an organization’s business success. This book is about equipping the readers with the required knowledge and skills to perform a penetration test against an Azure infrastructure. Within this book, the readers will develop a detailed understanding of what Azure is and how its core component functions, along with the ability to uncover vulnerabilities, develop and deploy proof-of-concept exploits.

This book systematically guides you through the technical workflow, beginning with cloud architecture and legal considerations, followed by threat intelligence and reconnaissance to map the attack surface. You immediately pivot to high-value targets, learning to exploit Azure AD for privilege escalation, auditing NSGs/VPNs for networking flaws, and attacking compute services. Finally, you will learn specialized testing of API Management, Key Vault access controls, bypassing security/monitoring services, simulating advanced threat scenarios and lateral movement, and concluding with professional reporting and remediation for continuous security improvement.

By the end of this book, you will have all the necessary knowledge to successfully conduct a penetration test against an Azure infrastructure. You will learn how to not only specify a penetration test, but also how to communicate your findings and understand what the Azure components are, and how they fit together. You will also have the ability to develop and validate proof-of-concept exploits.

WHAT YOU WILL LEARN
● Specifying and performing penetration test against an Azure infrastructure.
● Using threat intelligence in the specification process.
● Compromising Azure DevOps CI/CD Pipeline, Secrets Management, and Build Artifacts.
● Developing and validating proof-of-concept exploits using Python.
● Reporting and communicating the findings to the customer.
● Conducting red team lateral movement, APT simulation, and Zero Trust testing.
● Securing blob storage/SAS tokens.
● Exploiting vulnerabilities in App Services/serverless and SQL/NoSQL databases.

WHO THIS BOOK IS FOR
This book is for security practitioners, penetration testers, security engineers, and students who wish to learn Azure-specific security auditing.

1. Introduction to Penetration Testing on Azure
2. Threat Intelligence and Reconnaissance in Azure
3. Azure Identity and Access Management Testing
4. Testing Azure Network Security Configuration
5. Azure Compute Services Penetration Testing
6. Storage Security Testing in Azure
7. Testing Azure App Services and Web Applications
8. Azure Database Security Testing
9. Testing Azure DevOps and CI/CD Pipeline
10. Security Testing Azure API Management and Microservices
11. Azure Key Vault and Secrets Management Testing
12. Penetration Testing Azure Security and Monitoring Services
13. Advanced Threat Scenarios and Red Teaming in Azure
14. Reporting, Remediation, and Post-engagement Activities

Dr Andrew Blyth received his Ph.D. in computer science from Newcastle University, UK. He has authored numerous conference and journal papers on computer network attack and computer network defence. He was a professor of computer forensics and director of the cyber defence centre at the University of South Wales.

Dr. Blyth has worked as a penetration tester for more than thirty years and has authored numerous books on the subject. He has also served as a speaker at conferences such as Black Hat.