Track the Planet! Mapping IDs & Monitoring Presence in Azure
Alexander Hagenah details unauthenticated, zero-log user enumeration techniques across Microsoft Azure, Teams, and OneDrive spanning millions of accounts.
Summary
Silent Reconnaissance in Cloud Directories
Reconnaissance against enterprise cloud environments typically generates audit logs, but subtle API design behaviors in Microsoft Azure permit silent, zero-log account discovery.
Unauthenticated Enumeration via OneDrive and Teams
Alexander Hagenah reveals how querying OneDrive endpoints and unauthenticated Microsoft Teams presence lookup APIs reveals valid usernames without triggering logon events or failed authentication logs.
Mapping Enterprise Adoption and Online Presence
Demonstrating datasets of over 20 million enumerated accounts illustrates how telemetry from out-of-office messages and Teams status indicators enables organizational mapping at scale.
Discovering Hidden Cross-Tenant Relationships
Exploiting Azure Guest collaboration metadata uncovers hidden business partnerships and joint venture relationships between distinct corporate tenants.
Related talks
Main Stage·42 min
Dirk-jan Mollema
Demonstrates a complete Azure Active Directory attack chain from initial access through Global Administrator privilege escalation.
Village Interviews·1 min
An inside look at the Recon Village CTF, testing OSINT investigative methodology, public records pivots, and asset discovery.
Adversary Village·26 min
Shantanu Khandelwal
Shantanu Khandelwal presents GitHub Credentials Stroller, an automated OSINT reconnaissance tool that deep-scans developer repositories for exposed credentials.