Key Vault – Modify the Access Policy and extract the certificate – Abstract: Azure Key Vault allows you to manage multiple versions of cryptographic keys, enabling older versions of keys to decrypt encrypted values stored in secrets, ensuring that data encrypted with previous keys remains accessible even after key rotation.
Gain Access to Google Cloud Storage Buckets with Viewer Role – Abstract: In this hands-on lab, we will see how a user with Viewer role can gain access to files that are stored in Google Cloud Storage Buckets.
Exploit GitHub Insecure Contexts – Abstract: In this hands-on lab, you will explore how attackers can exploit insecure context injection in GitHub Actions workflows to execute unauthorized commands, leak sensitive data, or manipulate pipeline behavior. GitHub Actions relies on various contexts (such as secrets, variables, and environment variables) to provide dynamic values to workflows. However, if these contexts are improperly used in scripts, commands, or workflows, they can be tampered with by attackers to escalate privileges or execute arbitrary code.
You will first take on the role of an attacker, identifying insecure context usage in a vulnerable GitHub Actions workflow and injecting malicious inputs to compromise the pipeline. Then, you will transition to a defensive approach, implementing best practices to sanitize inputs, restrict context exposure, and secure workflow execution.
Accessing Azure DevOps via Function App Managed Identity – Abstract: This lab demonstrates how an attacker can laterally move within Azure by exploiting over-permissioned Managed Identities. Specifically, students will simulate compromising a Function App’s managed identity that has access to an Azure DevOps organization. Using token abuse techniques, the lab walks through how to extract access tokens, enumerate DevOps projects, and access variable groups that may contain sensitive information such as service principal credentials.
The scenario highlights the importance of managing identity scope and reviewing cloud service permissions to prevent unintended lateral movement and exposure of sensitive DevOps pipelines.
Repository Access and Privilege Escalation via Service Principal on Self-Hosted Agent – Abstract: This lab demonstrates how attackers can escalate privileges and gain code execution by abusing exposed service principal credentials in Azure DevOps environments. Building upon the credentials discovered in the previous lab, students will enumerate DevOps repositories, extract source code, and tamper with a pipeline file that runs on a self-hosted agent. By injecting a malicious reverse shell payload into a script executed by the pipeline, the attacker gains interactive access to the agent’s underlying virtual machine. This lab highlights how access to code repositories and pipelines, even without direct admin rights, can lead to full system compromise when self-hosted agents are misconfigured or under protected.
