This was a fun one to dig into.
Ever wonder how Azure Easy Auth really works, and how to break it?
Turns out it's pretty easy, and it may be abusable for priv esc and lateral movement:
dazesecurity.io/blog/abusing...
Looking forward to posting this one. I'm guessing it's another "by design", In which case all you Azure Security folks should stay tuned
Corrected link: codyburkard.com/blog/abusing... 😊
Are you an Azure Pentester looking for new lateral movement techniques?
Take a look at my blog post about abusing Data Factory to steal secrets and tokens.
Thanks @karimscloud.bsky.social for the inspiration to look into this.
codyburkard.com/abusingselfh...