# Cloud Pentesting

Published articles for Cloud Pentesting.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Modern Adventures in Azure Privilege Escalation

DevFeed: [Modern Adventures in Azure Privilege Escalation](<https://devfeed.tech/articles/modern-adventures-in-azure-privilege-escalation-54737.md>)

Original publisher: [Read original article](<https://www.netspi.com/blog/technical-blog/cloud-pentesting/modern-adventures-in-azure-privilege-escalation/>)

Author: Thomas Elling

Published: 2026-09-03T16:00:00Z

Content type: article

Language: en

Sources: [NetSPI](<https://devfeed.tech/sources/netspi.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [rbac](<https://devfeed.tech/topics/rbac.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>)

Tags: [attack-surface](<https://devfeed.tech/tags/attack-surface.md>), [azure](<https://devfeed.tech/tags/azure.md>), [azure-rbac](<https://devfeed.tech/tags/azure-rbac.md>), [cloud-pentesting](<https://devfeed.tech/tags/cloud-pentesting.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [privilege-escalation](<https://devfeed.tech/tags/privilege-escalation.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [roles](<https://devfeed.tech/tags/roles.md>)

### AI overview

This technical blog examines Azure RBAC and privilege escalation as Azure's services, roles, and permissions expand. It explains how mapping individual permissions, role assignments, and API endpoints can reveal escalation paths, including a reported and fixed issue involving elevation to Owner.

### Source excerpt

Azure has been growing rapidly over the past few years As of June 2026, there were over 200 services, 897 built-in Azure RBAC roles, and 22,018 different permissions. The attack surface of Azure has also increased with this growth. There are also a number of new and updated tools that give us insight into the The post Modern Adventures in Azure Privilege Escalation appeared first on NetSPI.

## Azure VM Command Execution using Third-Party Extensions - Salt Minion

DevFeed: [Azure VM Command Execution using Third-Party Extensions - Salt Minion](<https://devfeed.tech/articles/azure-vm-command-execution-using-third-party-extensions-salt-minion-54735.md>)

Original publisher: [Read original article](<https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions-part-2/>)

Author: Thomas Byrne

Published: 2026-07-27T20:01:07Z

Content type: article

Language: en

Sources: [NetSPI](<https://devfeed.tech/sources/netspi.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [Extension](<https://devfeed.tech/topics/extension.md>), [Code](<https://devfeed.tech/topics/code.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [remote access](<https://devfeed.tech/topics/remote-access.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [automation](<https://devfeed.tech/tags/automation.md>), [azure](<https://devfeed.tech/tags/azure.md>), [azure-virtual-machines](<https://devfeed.tech/tags/azure-virtual-machines.md>), [cloud-pentesting](<https://devfeed.tech/tags/cloud-pentesting.md>), [code](<https://devfeed.tech/tags/code.md>), [detective-controls-testing](<https://devfeed.tech/tags/detective-controls-testing.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [linux](<https://devfeed.tech/tags/linux.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains how attackers can abuse legitimate third-party extensions on Azure Virtual Machines to execute arbitrary code and maintain remote access. It focuses on deploying a Salt Minion extension connected to a rogue Salt Master, including the attack setup, malicious Salt state, and execution across Linux and Windows virtual machines.

### Source excerpt

In part two of our series, learn how attackers can leverage this legitimate tool to achieve undetected, arbitrary code execution as root, and explore the key detection methods you need to protect your Linux and Windows environments. The post Azure VM Command Execution using Third-Party Extensions - Salt Minion appeared first on NetSPI.

## Azure VM Command Execution using Third-Party Extensions - Chef

DevFeed: [Azure VM Command Execution using Third-Party Extensions - Chef](<https://devfeed.tech/articles/azure-vm-command-execution-using-third-party-extensions-chef-54736.md>)

Original publisher: [Read original article](<https://www.netspi.com/blog/technical-blog/cloud-pentesting/azure-vm-command-execution-using-third-party-extensions/>)

Author: Thomas Byrne

Published: 2026-07-21T20:07:31Z

Content type: article

Language: en

Sources: [NetSPI](<https://devfeed.tech/sources/netspi.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [Extension](<https://devfeed.tech/topics/extension.md>), [execution](<https://devfeed.tech/topics/execution.md>), [configuration-management](<https://devfeed.tech/topics/configuration-management.md>), [remote access](<https://devfeed.tech/topics/remote-access.md>), [cloud-infrastructure](<https://devfeed.tech/topics/cloud-infrastructure.md>)

Tags: [azure](<https://devfeed.tech/tags/azure.md>), [azure-marketplace](<https://devfeed.tech/tags/azure-marketplace.md>), [azure-virtual-machines](<https://devfeed.tech/tags/azure-virtual-machines.md>), [chef](<https://devfeed.tech/tags/chef.md>), [cloud-pentesting](<https://devfeed.tech/tags/cloud-pentesting.md>), [configuration-management](<https://devfeed.tech/tags/configuration-management.md>), [detective-controls-testing](<https://devfeed.tech/tags/detective-controls-testing.md>), [execution](<https://devfeed.tech/tags/execution.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [remote-access](<https://devfeed.tech/tags/remote-access.md>)

### AI overview

This technical security post explains how privileged Azure principals can abuse legitimate third-party VM extensions, particularly Chef, to execute arbitrary commands and maintain remote access. It focuses on deploying malicious Chef configurations and extracting managed identity tokens.

### Source excerpt

Discover how a privileged principal in Azure can abuse third-party extensions like Chef to achieve arbitrary command execution on target VMs by deploying malicious cookbooks to extract Managed Identity tokens. The post Azure VM Command Execution using Third-Party Extensions - Chef appeared first on NetSPI.