CHRISTIAN BORTONE

I am penetration tester and security researcher in my free time. I enjoy diving deep into Active Directory, Azure, and uncovering undocumented aspects of Microsoft technologies.

All Posts

2024

Azure Application Proxy Hijacking

Azure Application Proxy offers a groundbreaking solution for remote users needing access to on-premises web applications. By integrating seamlessly with Microsoft Entra ID for one-time...

Exploiting Azure Arc Management Tool to Capture NetNTLM Hashes

In a Windows network, NT LAN Manager (NTLM) is a set of Microsoft security protocols that ensure authentication, integrity, and confidentiality for users. It was...

Exploiting SNI SSRF to Access Azure Instance Metadata Service

Server-side request forgery (SSRF) is a well-known vulnerability that has gained renewed attention in recent years, particularly in cloud environments. Hackers and penetration testers have...

Abusing Azure Arc: From Service Principal Exposed to Reverse Shell

Over the past year, I have explored the capabilities of Azure Arc, a service that integrates and extends on-premises environments with cloud infrastructure. Recognizing its...