Penetration Testing Azure for Ethical Hackers: Develop practical skills to perform pentesting and risk assessment of Microsoft Azure environments

by David Okeyode, Rogier Dijkman, Karl Fosaaen

Overview

Go from security novice to ethical hacking expert and discover vulnerabilities before attackers can exploit them with the help of real-world attack simulations and hands-on labs

Key Features

• Discover how attackers find and abuse cloud misconfiguration, weak identity controls, and exposed IDs
• Learn advanced techniques for privilege escalation, moving across Azure tenants, and maintaining persistence
• Stay ahead of evolving threats with cutting-edge attack techniques, automated exploits, and real-world case studies
• Purchase of the print or Kindle book includes a free PDF eBook

Book Description

The rapid growth of cloud computing and Microsoft Azure’s vast capabilities have made it a prime target for attackers. Penetration Testing Azure for Ethical Hackers is your hands-on guide to staying ahead of these threats by learning how to identify and fix vulnerabilities before they’re exploited. Building on the success of its predecessor, this second edition is fully updated to cover modern attack strategies, sophisticated privilege escalation methods, and emerging Azure security challenges. Starting with the setting up of a dedicated Azure penetration testing environment, the book systematically guides you through reconnaissance methods, lateral movement tactics, and persistence techniques specifically engineered for Azure cloud environments. Through real-world case studies, step-by-step attack simulations, and mitigation strategies, you’ll develop practical skills for strengthening your organization's security posture. By the end, you’ll be equipped with the knowledge and technical skills needed to perform advanced Azure security assessments effectively.

What you will learn

• Set up an Azure pentesting lab personalized for you
• Anonymously search for high-risk misconfigurations and vulnerabilities
• Execute initial access attacks like credential theft and phishing
• Escalate privileges via misconfigured roles and resource policies
• Exploit service credentials, access keys, Azure Key Vault, and tokens
• Exfiltrate data from Azure Storage, SQL database, and serverless applications
• Maintain persistence using Logic Apps, Azure Functions, and identities

Who this book is for

This book is for cybersecurity professionals, penetration testers, cloud security specialists, and IT administrators who want to simulate real-world attacks on Microsoft Azure environments. If you're an Azure administrator, developer, or DevOps engineer looking to secure your infrastructure against potential attackers, this book is an essential guide to identifying and mitigating risks effectively.

Product Details

ISBN-13:	9781835880586
Publisher:	Packt Publishing
Publication date:	07/08/2026
Product dimensions:	75.00(w) x 92.50(h) x (d)

About the Author

David Okeyode is a leading cloud security architect with extensive experience in Azure security consulting, training, and research. He has authored multiple cloud security courses and speaks at major cybersecurity events worldwide.

Rogier Dijkman is a cloud security architect, security researcher, and active contributor to multiple security projects. With deep expertise in Microsoft Azure, he has developed numerous tools for both offensive and defensive security within Azure and Entra ID. As the founder of the SecureHats community, Rogier actively shares his insights and innovations through his blog and various security initiatives. His contributions to the field have earned him recognition as a Microsoft Security MVP for several years.

As a Practice Director at NetSPI, Karl leads the Cloud Penetration Testing service line and oversees NetSPI's Portland, OR office. Karl holds a BS in Computer Science from the University of Minnesota and has over a decade of consulting experience in the computer security industry. Karl spends most of his research time focusing on Azure security and contributing to the NetSPI blog. As part of this research, Karl created the MicroBurst toolkit on GitHub to house many of the PowerShell tools that he uses for testing Azure.

Table of Contents

Table of Contents

1. Azure Platform and Architecture Overview
2. Building Your Azure Pentesting Environment
3. Anonymous Discovery and Reconnaissance
4. Initial Access and Credential Theft
5. Privilege Escalation Attacks
6. Hunting and Harvesting Service Credentials
7. Data Exfiltration Attacks
8. Code Execution Attacks
9. Persistence Attacks and Defense Evasion