
Penetration Testing Azure for Ethical Hackers
By :

Azure web apps are commonly used in subscriptions to host web applications and APIs. While we have previously mentioned abusing managed identities, we have not covered how the applications are typically managed.
Application code can be applied to App Service hosts in multiple different ways. The Deployment Center can integrate with a number of different code repository solutions to synchronize with CI/CD pipelines, or code can be pushed through manual deployments.
Figure 6.48 – App Service Deployment Center
Application code can be manually copied to systems by using credentials stored in the publish profile. This profile contains the following credential options:
As an attacker with the Contributor role on the App Service application, we can access this publish profile to gain access to the credentials...