This was a fun one to dig into.

Ever wonder how Azure Easy Auth really works, and how to break it?

Turns out it's pretty easy, and it may be abusable for priv esc and lateral movement:

dazesecurity.io/blog/abusing...

Looking forward to posting this one. I'm guessing it's another "by design", In which case all you Azure Security folks should stay tuned

Are you an Azure Pentester looking for new lateral movement techniques?

Take a look at my blog post about abusing Data Factory to steal secrets and tokens.

Thanks @karimscloud.bsky.social for the inspiration to look into this.

codyburkard.com/abusingselfh...

Hello BlueSky World :)

I am an Azure Security researcher living in Norway. I research attack techniques against Entra, Azure, and applications built in Azure.

You can find my blog at codyburkard.com