CHRISTIAN BORTONE

I am penetration tester and security researcher in my free time. I enjoy diving deep into Active Directory, Azure, and uncovering undocumented aspects of Microsoft technologies.

All Posts

2025

When Azure Dynamic Groups Meet Weak ACLs

Dynamic groups in Entra ID allow administrators to automatically manage group memberships by using user attributes. For instance, if an organization has different departments, it...

Privilege Escalation in Azure Machine Learning

A few months ago, when browsing through the Azure services list, I stumbled upon Azure Machine Learning. The sheer number of capabilities and complexity of...

Azure Application Proxy Hijacking

Azure Application Proxy offers a groundbreaking solution for remote users who need access to on-premises web applications. It is integrated with Microsoft Entra ID for...

Exploiting Azure Arc Management Tool to Capture NetNTLM Hashes

NT LAN Manager (NTLM) in a Windows network is a set of Microsoft security protocols that helps to authenticate the identity of users, secure data,...

Exploiting SNI SSRF to Access Azure Instance Metadata Service

Server-side request forgery is a well known vulnerability that has gained renewed attention in recent years, particularly in cloud environments. Hackers and penetration testers have...

Abusing Azure Arc: From Service Principal Exposed to Reverse Shell

Over the past year, I have explored the capabilities of Azure Arc, a service that integrates and extends on-premises environments with cloud infrastructure. Recognizing its...