AzureHound

AzureHound 用于 Microsoft Azure 的 BloodHound 数据收集器 获取 AzureHound 发布二进制文件 请从我们的 Releases 页面下载适用于您平台的二进制文件。 滚动发布 滚动发布包含预构建的二进制文件，这些文件会自动与 main 分支保持同步，可从 此处 下载。 警告： 滚动发布可能不稳定。 编译 先决条件 Go 1.25 或更高版本 要从源代码构建此项目，请运行以下命令： root@kitploit: go build -ldflags="-s -w -X...

oauthseeker

OAuthSeeker OAuthSeeker es una herramienta de equipo rojo para realizar ataques de phishing utilizando aplicaciones OAuth maliciosas para comprometer identidades de usuarios en Microsoft Azure y Office365. 🚀 Características principales OAuthSeeker proporciona las siguientes características...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

offensive-azure

一组针对 Microsoft Azure 的攻击工具集合，使用 Python 编写以实现平台无关性。当前工具列表及其简要功能描述如下。 ./DeviceCode/devicecodeeasymode.py 生成一个供目标用户输入的代码 可用于通用令牌生成，或在钓鱼/社会工程攻击活动中使用。 ./AccessTokens/tokenjuggle.py 以多种方式接收一个刷新令牌，并为指定资源获取一个新的刷新令牌和一个访问令牌 ./AccessTokens/readtoken.py 接收一个访问令牌，解析其包含的声明信息，检查过期时间，并尝试验证签名...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker buil...

AzureADAssessment

Evaluación de Microsoft Azure AD Guía del evaluador Si usted es un empleado o partner de Microsoft que realiza la evaluación para un cliente, consulte la Wiki para la Guía de evaluación. Instalación desde la Galería de PowerShell Si encuentra algún error, consulte la sección de preguntas frecuent...

GO-2026-6259 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-microsoft-azure, velero-plugin-for-gcp, velero-plugin-for-aws, velero-plugin-for-aws-fips, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-gcp-fips...

GO-2026-6259 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, velero-plugin-for-microsoft-azure...

CVE-2026-32637 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, velero-plugin-for-microsoft-azure...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, velero-plugin-for-microsoft-azure...

CVE-2026-69400 Azure Logic Apps Elevation of Privilege Vulnerability

...

CVE-2026-68782 Azure SQL Database Elevation of Privilege Vulnerability

...

CVE-2026-66309 Azure SQL Database Elevation of Privilege Vulnerability

...

KLA91236 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability...

CVE-2026-71331

Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

EUVD-2026-56771

Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network...

CVE-2026-63522

Azure SQL Database is the affected product for CVE-2026-63522, described as an incorrect permission assignment for a critical resource that allows an authorized attacker to elevate privileges locally. The issue has a base CVSSv3.1 score of 7.8 (HIGH) with LOCAL access, low attack complexity, and ...

EUVD-2026-56746

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network...

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...