Microsoft is releasing many new security features and they are investing a lot, this is a very good sign of good commitment for a company.

Of of the major security features are Security Center, a unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud – whether they’re in Azure or not – as well as on premises.

The last arrived, Azure Sentinel, now in preview, it provides intelligent security analytics for your entire enterprise at cloud scale. Get limitless cloud speed and scale to help focus on what really matters. Easily collect data from all your cloud or on-premises assets, Office 365, Azure resources, and other clouds. Effectively detect threats with built-in machine learning from Microsoft’s security analytics experts. Automate threat response, using built-in orchestration and automation playbooks.

Behind the scenes, these features are actually providing security automation capabilities with amazing reporting, alerting, running books etcetera and we can do a lot more with the support of the open source world.

Azure provides great automation capabilities using automation account and blueprint, and other great options are Containers.

I think the containerization is a very powerfull option, in azure I use Service Fabric and Docker, in different compbinations, depending on the usage.

One good example is the using of great security tool like OWASP ZAP, it provides a very extensive API interface and Docker images.

For Docker hosting we have several options like Virtual Machine, Service Fabric, and we can use Azure Container Registry with Azure CI.

In docker we can install ZAP using the command below.

docker pull -t sfpsecuritycontainer.azurecr.io/owasp/zap2docker-stable

We can also use the weekly distribution option for a continuos update.

Run ZAP using the command below

docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.disablekey=true -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true

We can directly browse the API

And try and execute them directly from UI and test them before the usage.

We can scan targets and produce our logs and push our logs in the Azure Workspace, this is to integrate our security tools into assets like Security Center and Sentinel.

Azure Bastion let you connect via RDP and SSH to any VM in Microsoft Azure using the private IP addresses and avoiding any public exposure.
You can find many blog posts in interne and to install bastion, you can follow these the simple steps in the article below

https://docs.microsoft.com/en-gb/azure/bastion/bastion-create-host-portal

Azure Bastion has these main requirements:

1. You must have a VNet
2. In the VNet you must have a subnet named AzureBastionSubnet
3. No route tables or delegations in the Bastion subnet
4. You must use a subnet of at least /27 CIDR.

The only main restriction I see is the using of a subnet with a specific name because in a complex and well organised network scenario, all the address spaces are catalogued and organised and the creation of a new subnet may require some changes on it.

The using of a new VNet and peering is not an applicable option because the VNet hosting the VM requires a subnet named AzureBastionSubnet anyway.

After some tests, below the applicable options.

New VNet

Of course, this is the simpler and the fastest, all articles mention that you create a new VNet with a subnet AzureBastionSubnet and you install your VMs in that VNet + Azure Bastion.
This method is easy, and it is a good option in case of a new VNet, but there is an important aspect to consider here, Azure Bastion requires a /27 subnet, which is an important amount of IP addresses (32).
I don’t really like the idea of using 32 IPs for that, especially because it can be reserved for many other critical scopes, but if you have small, medium company this is very applicable.

Creation of a new subnet in an existing VNet

I don’t like this idea but you can actually to do that using this option, and I will explain to you why I don’t like it.
You can change the address space of your VNet and add more space in your network, after that you can add the new subnet named AzureBastionSubnet.

As I mentioned before, this is not easily applicable in a well organised network infrastructure because the addresses spaces have been already assigned to regions and departments and this method will require an important effort for the network team.

If you don’t have this problem, then I would say that maybe you still need to organise your network strategy and I would recommend you to do that asap.

Dedicate an address space to Azure Bastion

This is, in my opinion, the best option for using Azure Bastion.

We dedicate a specific IP schema for Azure Bastion, for example, the 192.168.*.*, and we use these IP schemas for that only.

As you can see below, you can add the new addresses space to you VNet

And you can create the AzureBastionSubnet subnet

This is the best way to use Azure Bastion because you dedicate a specific IP range to that and you touch you network design at all.

This article assumes the reader has a basic understanding of Azure security and governance.

Many companies are exposing public IP and ports from Microsoft Azure, and many of them are unaware of that, a good practice is to check what we have open and why.

The port scanning of an Azure infrastructure can be very challenging, especially in global and enterprise scenarios where many Enterprise Agreements and subscriptions are involved.
We have some options to solve this problem:

The first option is using PowerShell/Az CLI and create a script to list all ports opened by network security groups and firewalls, but I see a big problem on using this option.
Companies and department can decide different security firewalling strategies, it can be a network security group or Fortigate, for example.

The second option can be using Azure APIs, which honestly is pretty powerful, and we work in JSON format for data that is very serializable and easy to manipulate, but also, in this case, we still have the same problem,
we are not sure about what is protecting the IP exposing the port.

The best solution is performing an active scan in all IP we find and using a proper tool like NMAP to do that, the reason for that is because I want to be sure about the ports open and I don’t want to depend by any API.

I consider NMAP one of the most powerful hacking tools which tons of options, not just scanning but also for advanced pentest operations, I recommend you to look at it.

Because of the complexity of a global Azure environment, the two main problems I see are about the reconnaissance and collecting all data I need and, second is the mapping between the IP and ports scanned and the Azure resource related, actually NMAP provides the possibility of scanning a list of IPs but how to map the hundreds of IP provided by NMAP with the related Azure resources?

For that reason, I decided to integrate active hacking capabilities in Aziverso, which already has very powerful reconnaissance features and mix them together.

To access on any Azure resource, you need to setup an Azure service principal account or using an existing one, you can find all info in https://aziverso.com, and you associate the account to the scope area you want to scan, it can be a management group or multiple subscriptions.

If you like to scan the entire Azure Tenant you need to execute a privileged escalation to Global Admin and add the account to the Tenant Root Group

To obtain the full visibility you also need to escalate in the Azure AD Access management for Azure resources, set it to YES

Log off and back again and you will see any Azure resource, subscription or management group associated with this tenant, they can be even related to other Enterprise Agreements and contracts, it doesn’t matter.

For privacy reasons, I am going to use my personal Azure environment, which actually contains five different subscriptions, I did the same operation with hundreds of subscriptions and different Azure EA without any issue.

First, I execute Excel, and from Aziverso Scaffold, I scan the tenant to retrieve the list of all subscription I see.

Now I have my surface attack, and it can also be a list of hundreds of subscriptions.

Now I use the Recon to retrieve all Public IP, the recon is a crazy amazing feature, it lists more than 2000 Azure APIs, and I can map the Excel sheets to map the values I want to pass to the API

Now I have the list of all public IP

The blanks are not actually used of assigned so we can easily filter these using the Excel powerful filter and eliminate them from the list

Now let do the magic, and it is time to scan!

In Aziverso I select Attack in the new Hacking area, and it will open the new feature

I select the type of attack I want to perform, in this case, an IP scan and it will use the powerful NMAP capabilities for that.

I clean up all parameters and press Scan (I am planning for a smart parameters mapping, no time for that now ), go and take a good lunch + a coffee

And here we have all the results!

The great thing is also the possibility to have the link of the specific Azure resource scanned, and I can directly jump into the portal from Excel.

I am still working on this feature, and I will release in public very soon, feel free to contact me for any question and especially for collaboration, any kind of collaboration, code, design, hacking.

I have in plan many other hacking implementations like including advanced NMAP scans, Metasploit, Social-Engineer Toolkit, and with the inclusion of Windows Subsystem for Linux (WSL2) ,the pentest and hacking potentials are endless.
For example, performing a scan on all the App Service endpoints in the entire tenant.

stay tuned! And ping me!