> For the complete documentation index, see [llms.txt](https://l33t-en0ugh.gitbook.io/infosec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://l33t-en0ugh.gitbook.io/infosec/cloud-pentesting/pentesting-azure-active-directory.md).

# Pentesting Azure Active Directory

## Unauthenticated Recon

### User Email Enumeration

> <https://github.com/nyxgeek/onedrive_user_enum>

```javascript
python3 onedrive_enum.py -U users.txt -d companyname.com -v 
```

If the output urls gave us `404 File Not Found` , that mean it's a bad/invalid users or

If it redirect to sigin page, that mean it's a valid user account.

### Valid Email Enumeration

> <https://github.com/LMGsec/o365creeper>

```javascript
python3 o365creeper.py -e test@email.com
python3 o365creeper.py -f email-list.txt -o validated-out-file.txt
```

### Cloud Enum

> <https://github.com/initstring/cloud_enum>

```
python3 cloud_enum.py -k tesla --disable-aws --disable-gcp
```

### Password Spraying

> <https://github.com/dafthack/MSOLSpray>

```powershell
Import-Module .\MSQLSpray.ps1
Invoke-MSOLSpray -UserList .\mails.txt.txt -Password P@ssword123
```

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FyMFxkzhS4e9VCa7tICdM%2Fimage.png?alt=media\&token=80c8dd46-3bf5-43b0-93fa-860e8f10fdff)

## Authenticated Recon

First, we need to install Azure Az powershell module

```
Import-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force
```

Connect Azure account with `Connect-AzAccount`

![](https://3759110756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FVvHHLY2mrxd5y4e2vVYL%2Fuploads%2FqEb5TFNYQlI3fHlttHiP%2Fimage.png?alt=media\&token=2c73e0a0-63e8-45e2-b783-391b20dca1a9)

### Enumerating with Powershell

```powershell
# List current users context available
Get-AzContext -ListAvailable
# Getting subscription
Get-AzSubscription
# Current user's role assignment
Get-AzRoleAssignment
# List all the resources and group
Get-AzResource
Get-AzResourceGroup
# List storage accounts
Get-AzStorageAccount
# List all WebApp for exploit
Get-AzWebApp
# List Automation Account
Get-AzAutomationAccount
# Display all the virtual network
Get-AzVirtualNetwork
# Getting public ip address
Get-AzPublicIpAddress
```

{% hint style="success" %}
Continues...
{% endhint %}