azure-pentesting-suite (azpt)

🚧 Public beta. azpt is under active development — commands, flags, and output formats may still change between releases. Bug reports and feedback are welcome via GitHub issues.

azpt is a Go toolkit for authorized Azure security assessments. It works from two perspectives:

• Authenticated (you hold Azure credentials): enumerate subscriptions and resources, and audit them for misconfigurations.
• Anonymous (no credentials at all): attack public Blob storage the way an external attacker would — list containers, enumerate blob versions, and pull down secret-bearing files that the live site no longer references.

⚠️ Authorized use only. Run this only against tenants, subscriptions, and storage accounts you have explicit written permission to test. The anonymous blob commands touch third-party infrastructure over the internet — scope them to your engagement.

All examples below target a fictional Acme Corp whose static marketing site is hosted from an Azure storage account named acmewebsite (https://acmewebsite.blob.core.windows.net).

---

Documentation

Full documentation lives in docs/:

• In-depth guides (docs/guides/) — per feature: how the technique works, the exact Azure RBAC / Microsoft Graph permission it needs, the key flags explained, examples, and OPSEC / detection notes — organized by engagement phase.
• Scenario walkthroughs (docs/guides/scenarios/) — end-to-end attack narratives that chain commands across phases (token → Global Admin, Golden SAML takeover, PRT theft, consent phishing → M365, managed-identity lateral movement, offline directory hunt, device-code phishing), each with OPSEC and cleanup.
• Command reference (docs/reference/) — an auto-generated page per command with every flag (name, shorthand, type, default, description). Regenerate with azpt gen-docs docs/reference; the same info prints from azpt <command> --help.

---

Table of contents

• Install
• Quick start
• Authentication
• Command reference
• Walkthrough: anonymous blob attack
• Findings
• Output formats
• Architecture
• Development
• Roadmap
• License

---

Install

Prebuilt binary

Download the archive for your platform from the latest release, verify it, and extract:

# adjust VERSION/OS/ARCH to match the asset you downloaded
tar -xzf azpt_<VERSION>_<OS>_<ARCH>.tar.gz
sha256sum -c --ignore-missing SHA256SUMS

Binaries are static (CGO_ENABLED=0) and need no runtime dependencies. Builds are published for linux and darwin on amd64 and arm64.

Windows binaries are not published. The Windows-only helpers (prt extract, adconnect sync-creds, DPAPI) still build from source with go build -o azpt.exe . on a Windows host.

From source

Requires Go 1.26+.

git clone https://github.com/hac01/azure-pentesting-suite.git
cd azure-pentesting-suite
go build -o azpt .

This produces a self-contained azpt binary in the repo root. You can also run without building via go run . <command> from the repo directory.

---

Quick start

No Azure login is needed for the anonymous blob commands:

# One command: probe Acme's storage, enumerate versions, flag secret files
./azpt blob hunt --account acmewebsite

With Azure credentials (az login), assess from the inside — both the resource plane (ARM) and the directory (Entra ID / Graph):

./azpt enum whoami                 # who am I authenticated as?
./azpt enum subscriptions          # what subscriptions can this principal see?
./azpt audit storage               # misconfigured storage accounts
./azpt enum users                  # dump the Entra ID directory (Graph)

A common chain: recover a credential anonymously with blob hunt, log in as that user (az login), check what it can do with enum access, then loot any Key Vaults you can reach:

./azpt enum access                        # token scopes, directory roles, groups, RBAC roles
./azpt enum resources                     # find Key Vaults (type: vaults)
./azpt vault list --vault ext-contractors # secrets, keys, certs in that vault
./azpt vault dump --vault ext-contractors # read every secret value (the loot)

---

Authentication

The anonymous blob commands need no authentication. Everything else uses the Azure default credential chain, which tries, in order: environment variables, workload identity, managed identity, and the Azure CLI (az login).

az login
./azpt enum subscriptions

Force explicit service-principal auth (useful for a scoped assessment identity) with flags or environment variables. Don't have one yet? az ad sp create-for-rbac --name azpt-assessment --role Reader --scopes /subscriptions/<subscription-id> mints one — see Getting started for the full walkthrough, including the Graph permissions RBAC alone won't grant you:

./azpt --tenant <tenant-id> --client-id <app-id> --client-secret <secret> \
       enum subscriptions

# equivalently:
export AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=...
./azpt enum subscriptions

Certificate-based auth (PFX or PEM):

./azpt --tenant <tenant-id> --client-id <app-id> \
       --certificate ./cert.pfx --cert-password 'P@ss' \
       enum subscriptions

Scope authenticated runs to specific subscriptions with --subscription (repeatable); the default is every subscription the principal can reach:

./azpt --subscription 00000000-1111-2222-3333-444444444444 audit storage

---

Command reference

🧪 marks a command still in beta: implemented and usable, but less battle-tested than the rest of the suite — expect rougher edges, and please report issues you hit.