Skip to main content
back to List back
on this page

Hacking Azure: From Zero To Cloud Admin

live online
price $1,400
Vaibhav
Beginner / Intermediate
2 Days
Cloud
Sun 22 Nov - Mon 23 Nov
price $1,400
Register


Online, Available in English

Overview

Azure has become the dominant platform for enterprise infrastructure. As organisations migrate critical workloads to the cloud, the attack surface shifts from the network perimeter to the identity and permissions layer. Practitioners trained in traditional web and network security often find themselves without the vocabulary or hands-on experience to operate confidently in this environment.
This two-day course is designed to close that gap. 

Day 1 and the first half of Day 2 work through the Azure attack surface service by service across twelve modules. Each module covers what a service does, where the attack surface lives, which ARM permissions matter, and how an attacker abuses 
misconfigurations in practice. Students leave each module with a working technique, not just a concept. 


The second half of Day 2 is a full-scenario capture-the-flag exercise set in an independently provisioned Azure tenant. Students apply everything from the preceding modules without guidance: finding the entry point, mapping the environment, escalating privileges, moving laterally across cloud services, and establishing persistence. 

The CTF window and the instructor walkthrough run as a single continuous session, so every flag is covered while the experience is still fresh. Each student works in a dedicated, real Azure tenant throughout both days. There are no shared sandboxes and no simulated API responses. The environment reflects misconfiguration patterns that appear regularly in real assessments.

 

Topics:

  • Module 1 Azure Architecture and Tenant Fundamentals
  • Module 2 Entra ID: Identities, Auth Flows, and App Registrations
  • Module 3 The ARM Permission Model and Sensitive Permission Identification
  • Module 4 Web Applications as Entry Points
  • Module 5 Tenant Enumeration and Attack Path Mapping
  • Module 6 Storage Accounts
  • Module 7 Key Vault and ARM Template Secrets
  • Module 8 Automation Accounts and Managed Identities
  • Module 9 Azure DevOps: Pipeline Security
  • Module 10 Function Apps and Logic Apps
  • Module 11 Azure Container Instances
  • Module 12 Persistence Techniques
  • Operation Cloud Heist CTF Window and Flag-by-Flag Walkthrough
  • Report Writing Exercise


Prerequisites And Target Audience 

The course is aimed at penetration testers and security practitioners who work in web or network security and want to add cloud offensive skills. It is equally suitable for cloud engineers and DevOps practitioners who want to understand how their Azure environments can be attacked, and for security analysts who need to understand attacker behaviour to improve detection coverage. 

Comfort running commands in a terminal is the only prerequisite. No Azure account, cloud certification, Active Directory knowledge, or scripting experience is required. Every lab command is provided verbatim in the lab guide. Students need a laptop capable of running a Windows virtual machine in VMware Workstation or VirtualBox.

 

By the end of this course, the participant will be able to: 

  • Explain how Azure identity and ARM permissions work
  • Exploit web vulnerabilities to gain cloud access
  • Enumerate a tenant and map attack paths
  • Abuse Storage Accounts and Key Vault
  • Escalate privileges through Automation Account misconfigurations
  • Move laterally across Azure DevOps, Function Apps, and Logic Apps
  • Execute code inside Azure Container Instances
  • Establish persistence that survives credential rotation
  • Complete an unguided attack chain in a CTF environment
  • Document Azure findings for a penetration test report