Thread by @shirtamari

Continuing the #BingBang thread, many have asked how we found the vulnerable Bing Trivia endpoint.

Let me share our unique Azure Active Directory cloud reconnaissance technique to find misconfigured authentication prompts🧵

We wanted to scan the internet🌎and measure how many Azure customers mistakenly misconfigured their Azure App Service and Azure Functions authentication, allowing anyone to log in

Most Azure App Service and Azure Functions are hosted under *.azurewebsites.net. So we used (the amazing 💙) @CommonCrawl and a commercial Passive DNS service to gather hundreds of thousands of azurewebsites subdomains

We then executed an HTTP scan across all of them and tried to detect the Microsoft Login page

We quickly noticed the AAD login page discloses the application's Client ID

This ID can provide us with a lot of information! We can query the Azure Graph API about it and discover details like App publisher, tenant ID, and if the app supports multi-tenant authentication🔎

Filtering results for multi-tenant apps under Microsoft's tenant eventually yielded bingtrivia.azurewebsites.net🎯

Then, it was just a matter of logging in and discovering the power that came with it⚡️

(As @Hillai describes in the original thread)

https://twitter.com/hillai/status/1641146508639600646