Az - Azure Mtandao

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Taarifa za Msingi

Azure hutoa virtual networks (VNet) ambazo zinawezesha watumiaji kuunda mitandao iliyotengwa ndani ya wingu la Azure. Ndani ya VNet hizi, rasilimali kama virtual machines, applications, databases… zinaweza kuendeshwa na kusimamiwa kwa usalama. Usanifu wa mtandao katika Azure unaunga mkono mawasiliano ndani ya wingu (katika huduma za Azure) pamoja na muunganisho kwa mitandao ya nje na intaneti.
Zaidi ya hayo, inawezekana kuunganisha VNet na VNet nyingine na na mitandao ya on-premise.

Mtandao wa Virtual (VNET) & Subnets

Azure Virtual Network (VNet) ni mwakilishi wa mtandao wako mwenyewe ndani ya wingu, ikitoa utengwa wa kimantiki ndani ya mazingira ya Azure yaliyowekwa kwa ada yako. VNet zinakuwezesha kuanzisha na kusimamia virtual private networks (VPNs) katika Azure, zikihifadhi rasilimali kama Virtual Machines (VMs), databases, na application services. Zinatoa udhibiti kamili juu ya mipangilio ya mtandao, ikijumuisha anuwai za anwani za IP, uundaji wa subnet, jedwali la njia, na gateways za mtandao.

Subnets ni mgawanyiko ndani ya VNet, uliowekwa kwa anuwai maalum za anwani za IP. Kwa kugawa VNet katika subnets nyingi, unaweza kupanga na kulinza rasilimali kulingana na usanifu wa mtandao wako.
Kwa chaguo-msingi subnets zote ndani ya Azure Virtual Network (VNet) moja zinaweza kuwasiliana kati yao bila vizuizi.

Mfano:

• MyVNet yenye anuwai ya anwani za IP 10.0.0.0/16.
• Subnet-1: 10.0.0.0/24 kwa seva za wavuti.
• Subnet-2: 10.0.1.0/24 kwa seva za hifadhidata.

Enumeration

Ili kuorodhesha VNet zote na subnets ndani ya akaunti ya Azure, unaweza kutumia Azure Command-Line Interface (CLI). Hapa kuna hatua:

# List VNets
az network vnet list --query "[].{name:name, location:location, addressSpace:addressSpace}"

# List subnets of a VNet
az network vnet subnet list --resource-group <ResourceGroupName> --vnet-name <VNetName> --query "[].{name:name, addressPrefix:addressPrefix}" -o table

# List VNets
Get-AzVirtualNetwork | Select-Object Name, Location, @{Name="AddressSpace"; Expression={$_.AddressSpace.AddressPrefixes}}

# List subnets of a VNet
Get-AzVirtualNetwork -ResourceGroupName <ResourceGroupName> -Name <VNetName> |
Select-Object -ExpandProperty Subnets |
Select-Object Name, AddressPrefix

Vikundi vya Usalama vya Mtandao (NSG)

A Network Security Group (NSG) huchuja trafiki ya mtandao kuingia na kutoka kwa rasilimali za Azure ndani ya Azure Virtual Network (VNet). Ina seti ya security rules ambazo zinaweza kuonyesha ni ports gani za kufungua kwa trafiki ya inbound na outbound kwa msingi wa source port, source IP, port destination, na inawezekana kuteua kipaumbele (nambari ndogo ya kipaumbele = kipaumbele cha juu).

NSGs zinaweza kuambatishwa kwa subnets and NICs.

Mfano wa sheria:

• Sheria ya inbound inayoruhusu trafiki ya HTTP (port 80) kutoka chanzo chochote hadi web servers zako.
• Sheria ya outbound inayoruhusu tu trafiki ya SQL (port 1433) kwenda kwa anuwai maalum ya destination IP.

Uorodheshaji

# List NSGs
az network nsg list --query "[].{name:name, location:location}" -o table
az network nsg show --name <nsg-name>

# Get NSG rules
az network nsg rule list --nsg-name <NSGName> --resource-group <ResourceGroupName> --query "[].{name:name, priority:priority, direction:direction, access:access, protocol:protocol, sourceAddressPrefix:sourceAddressPrefix, destinationAddressPrefix:destinationAddressPrefix, sourcePortRange:sourcePortRange, destinationPortRange:destinationPortRange}" -o table

# Get NICs and subnets using this NSG
az network nsg show --name <NSGName> --resource-group <ResourceGroupName> --query "{subnets: subnets, networkInterfaces: networkInterfaces}"

# List NSGs
Get-AzNetworkSecurityGroup | Select-Object Name, Location
Get-AzNetworkSecurityGroup -Name <NSGName> -ResourceGroupName <ResourceGroupName>

# Get NSG rules
Get-AzNetworkSecurityGroup -Name <NSGName> -ResourceGroupName <ResourceGroupName> |
Select-Object -ExpandProperty SecurityRules |
Select-Object Name, Priority, Direction, Access, Protocol, SourceAddressPrefix, DestinationAddressPrefix, SourcePortRange, DestinationPortRange

# Get NICs and subnets using this NSG
(Get-AzNetworkSecurityGroup -Name <NSGName> -ResourceGroupName <ResourceGroupName>).Subnets
(Get-AzNetworkSecurityGroup -Name <NSGName> -ResourceGroupName <ResourceGroupName>).NetworkInterfaces

Azure Firewall

Azure Firewall ni firewall iliyosimamiwa na stateful ambayo inachuja trafiki (L3–L7) kwa mtiririko wa mashariki-magharibi na kaskazini-kusini. Imewekwa kwenye ngazi ya VNet, inaleta ukaguzi wa kati kwa subnets zote na ina uwezo wa kujikokotoa (auto-scale) ili kuhakikisha upatikanaji.

SKUs zinazopatikana: Basic, Standard, na Premium:

Uorodheshaji

# List Azure Firewalls
az network firewall list --query "[].{name:name, location:location, subnet:subnet, publicIp:publicIp}" -o table

# Get network rules of a firewall
az network firewall network-rule collection list --firewall-name <FirewallName> --resource-group <ResourceGroupName> --query "[].{name:name, rules:rules}" -o table

# Get application rules of a firewall
az network firewall application-rule collection list --firewall-name <FirewallName> --resource-group <ResourceGroupName> --query "[].{name:name, rules:rules}" -o table

# Get nat rules of a firewall
az network firewall nat-rule collection list --firewall-name <FirewallName> --resource-group <ResourceGroupName> --query "[].{name:name, rules:rules}" -o table

# List Azure Firewalls
Get-AzFirewall

# Get network rules of a firewall
(Get-AzFirewall -Name <FirewallName> -ResourceGroupName <ResourceGroupName>).NetworkRuleCollections

# Get application rules of a firewall
(Get-AzFirewall -Name <FirewallName> -ResourceGroupName <ResourceGroupName>).ApplicationRuleCollections

# Get nat rules of a firewall
(Get-AzFirewall -Name <FirewallName> -ResourceGroupName <ResourceGroupName>).NatRuleCollections

Azure Route Tables

Azure Route Tables (UDR) zinakuwezesha kubadilisha routing ya chaguo-msingi kwa kuainisha destination prefixes (mfano, 10.0.0.0/16 au 0.0.0.0/0) na next hop (Virtual Network, Internet, Virtual Network Gateway, or Virtual Appliance).

Routes zinatumika kwa kiwango cha subnet; VMs zote katika subnet hiyo zinafuata jedwali.

Mfano:

• Kwa trafiki inayokwenda Internet, tumia default 0.0.0.0/0 na Internet kama next hop.
• Ili kuchunguza trafiki inayoelekea nje, elekeza 0.0.0.0/0 kwa IP ya Network Virtual Appliance (NVA).

Enumeration

# List Route Tables
az network route-table list --query "[].{name:name, resourceGroup:resourceGroup, location:location}" -o table

# List routes for a table (summary)
az network route-table route list --resource-group <ResourceGroupName> --route-table-name <RouteTableName> --query "[].{name:name, addressPrefix:addressPrefix, nextHopType:nextHopType, nextHopIpAddress:nextHopIpAddress}" -o table

# List routes for a table (full)
az network route-table route list --resource-group <ResourceGroupName> --route-table-name <RouteTableName>

# List Route Tables
Get-AzRouteTable

# List routes for a table
(Get-AzRouteTable -Name <RouteTableName> -ResourceGroupName <ResourceGroupName>).Routes

Azure Private Link

Azure Private Link ni huduma ndani ya Azure inayowezesha ufikiaji wa kibinafsi kwa huduma za Azure kwa kuhakikisha kwamba trafiki kati ya Azure virtual network (VNet) yako na huduma inasafiri kabisa ndani ya mtandao wa msingi wa Azure wa Microsoft. Kwa vitendo inaleta huduma ndani ya VNet yako. Mpangilio huu unaongeza usalama kwa kutoonyesha data kwenye intaneti ya umma.

Private Link inaweza kutumika na huduma mbalimbali za Azure, kama Azure Storage, Azure SQL Database, na huduma za kawaida zilizoshirikiwa kupitia Private Link. Inatoa njia salama ya kutumia huduma kutoka ndani ya VNet yako au hata kutoka kwenye subscriptions tofauti za Azure.

Caution

NSGs hazitekelezi kwa private endpoints; kwa hivyo kuhusisha NSG na subnet ambayo ina Private Link haitaathiri.

Example:

Fikiria hali ambapo una Azure SQL Database ambayo unataka kuifikia kwa usalama kutoka VNet yako. Kawaida, hii inaweza kuhitaji kusafiri kupitia intaneti ya umma. Kwa Private Link, unaweza kuunda private endpoint katika VNet yako ambayo inaunganishwa moja kwa moja na huduma ya Azure SQL Database. Endpoint hii inafanya database ionekane kama sehemu ya VNet yako mwenyewe, inapatikana kupitia anwani ya IP ya kibinafsi, hivyo kuhakikisha ufikiaji salama na wa kibinafsi.

Uorodheshaji

# List Private Link Services
az network private-link-service list --query "[].{name:name, location:location, resourceGroup:resourceGroup}" -o table

# List Private Endpoints
az network private-endpoint list --query "[].{name:name, location:location, resourceGroup:resourceGroup, privateLinkServiceConnections:privateLinkServiceConnections}" -o table

# List Private Link Services
Get-AzPrivateLinkService | Select-Object Name, Location, ResourceGroupName

# List Private Endpoints
Get-AzPrivateEndpoint | Select-Object Name, Location, ResourceGroupName, PrivateEndpointConnections

DNS OverDoS via service Private DNS zone links

When a VNet has a Virtual Network Link to a service Private DNS zone (e.g., privatelink.blob.core.windows.net), Azure forces hostname resolution for Private Link registered resources of that service type through the zone. If the zone lacks the required A record for a resource that workloads still access via its public endpoint, DNS resolution returns NXDOMAIN and clients never reach the public IP, causing an availability DoS without touching the resource itself.

Abuse flow (control-plane DoS):

1. Pata RBAC inayoruhusu kuunda Private Endpoints au kubadilisha Private DNS zone links.
2. Unda Private Endpoint kwa aina hiyo ya service katika VNet nyingine (Azure huunda kiotomatiki service Private DNS zone na kuiunga na VNet hiyo).
3. Unganisha ile service Private DNS zone na VNet ya mwathiriwa.
4. Kwa kuwa VNet ya mwathiriwa sasa inalazimisha utatuzi kupitia Private DNS zone na hakuna rekodi ya A kwa rasilimali lengwa katika zone hiyo, utatuzi wa majina unashindwa na workload haiwezi kufikia endpoint (iliyobaki kuwa ya umma). Hii inatumika kwa huduma yoyote inayoungwa mkono na Private Link (storage, Key Vault, ACR, Cosmos DB, Function Apps, OpenAI, etc.).

Discovery at scale (Azure Resource Graph):

• VNETs linked to the blob Private DNS zone (forced resolution for PL-registered blob endpoints):

resources
| where type == "microsoft.network/privatednszones/virtualnetworklinks"
| extend
zone = tostring(split(id, "/virtualNetworkLinks")[0]),
vnetId = tostring(properties.virtualNetwork.id)
| join kind=inner (
resources
| where type == "microsoft.network/privatednszones"
| where name == "privatelink.blob.core.windows.net"
| project zoneId = id
) on $left.zone == $right.zoneId
| project vnetId

• Storage accounts zinazofikiwa kupitia public endpoint lakini bila Private Endpoint connections (huenda zikavunjika ikiwa kiungo kilicho hapo juu kitaongezwa):

Resources
| where type == "microsoft.storage/storageaccounts"
| extend publicNetworkAccess = properties.publicNetworkAccess
| extend defaultAction = properties.networkAcls.defaultAction
| extend vnetRules = properties.networkAcls.virtualNetworkRules
| extend ipRules = properties.networkAcls.ipRules
| extend privateEndpoints = properties.privateEndpointConnections
| where publicNetworkAccess == "Enabled"
| where defaultAction == "Deny"
| where (isnull(privateEndpoints) or array_length(privateEndpoints) == 0)
| extend allowedVnets = iif(isnull(vnetRules), 0, array_length(vnetRules))
| extend allowedIps = iif(isnull(ipRules), 0, array_length(ipRules))
| where allowedVnets > 0 or allowedIps > 0
| project id, name, vnetRules, ipRules

Azure Service Endpoints

Azure Service Endpoints huongeza eneo la anwani za faragha za virtual network yako na utambulisho wa VNet yako kwa Azure services kupitia muunganisho wa moja kwa moja. Kwa kuwezesha service endpoints, rasilimali ndani ya VNet yako zinaweza kuunganishwa kwa usalama na Azure services, kama Azure Storage na Azure SQL Database, kupitia Azure backbone network. Hii ni muhimu hasa inapochanganywa na Network Security Groups (NSGs) kwa udhibiti wa trafiki kwa undani.

Mfano:

• Kwa Storage Account na Service Endpoint iliyowezeshwa katika VNET, inawezekana kuruhusu trafiki inayokuja kutoka tu kwa VNET iliyoko kwenye storage account firewall, kufanya iwe ya muunganisho salama bila kuhitaji upatikanaji wa IP ya umma kwa storage service.

Service Endpoints hazihitaji anwani za IP za kibinafsi kwa huduma na badala yake zinategemea Azure backbone kwa muunganisho salama. Ziko rahisi kuweka ikilinganishwa na Private Links lakini hazitoi kiwango sawa cha kutengwa na udhibiti wa undani kama Private Links.

Uorodheshaji

# List Virtual Networks with Service Endpoints
az network vnet list --query "[].{name:name, location:location, serviceEndpoints:serviceEndpoints}" -o table

# List Subnets with Service Endpoints
az network vnet subnet list --resource-group <ResourceGroupName> --vnet-name <VNetName> --query "[].{name:name, serviceEndpoints:serviceEndpoints}"

# List Service Endpoints for a Subnet
az network vnet subnet show --resource-group <ResourceGroupName> --vnet-name <VNetName> --name <SubnetName> --query "serviceEndpoints"

# List Virtual Networks with Service Endpoints
Get-AzVirtualNetwork

# List Subnets with Service Endpoints
(Get-AzVirtualNetwork -ResourceGroupName <ResourceGroupName> -Name <VNetName>).Subnets

Tofauti kati ya Service Endpoints na Private Links

Microsoft inapendekeza kutumia Private Links katika docs:

Service Endpoints:

• Trafiki kutoka VNet yako kwenda huduma ya Azure husafiri kupitia Microsoft Azure backbone network, ikiepuka internet ya umma.
• Endpoint ni muunganisho wa moja kwa moja kwa huduma ya Azure na hauwezi kutoa private IP kwa huduma ndani ya VNet.
• Huduma yenyewe bado inapatikana kupitia public endpoint yake kutoka nje ya VNet yako isipokuwa ukisanidi firewall ya huduma ili kuzuia trafiki hiyo.
• Ni uhusiano wa mmoja kwa mmoja kati ya subnet na huduma ya Azure.
• Ni nafuu zaidi kuliko Private Links.

Private Links:

• Private Link inaweka huduma za Azure ndani ya VNet yako kupitia private endpoint, ambayo ni network interface yenye private IP ndani ya VNet yako.
• Huduma ya Azure inapatikana kwa kutumia private IP hii, ikifanya ionekane kama sehemu ya mtandao wako.
• Huduma zilizounganishwa kupitia Private Link zinaweza kupatikana tu kutoka VNet yako au mitandao iliyounganishwa; hakuna ufikiaji kupitia internet ya umma kwa huduma hiyo.
• Inawawezesha muunganisho salama kwa huduma za Azure au huduma zako mwenyewe zilizo hifadhiwa katika Azure, pamoja na muunganisho kwa huduma zinazoshirikiwa na wengine.
• Inatoa udhibiti wa ufikiaji wenye uwiano mdogo (granular) kupitia private endpoint katika VNet yako, tofauti na udhibiti mpana wa ufikiaji kwenye ngazi ya subnet kwa service endpoints.

Kwa muhtasari, ingawa Service Endpoints na Private Links zote zinatoa muunganisho salama kwa huduma za Azure, Private Links zinatoa kiwango cha juu cha kutenganishwa na usalama kwa kuhakikisha huduma zinapatikana kwa njia ya kibinafsi bila kuziacha wazi kwenye internet ya umma. Service Endpoints, kwa upande mwingine, ni rahisi kusanidi kwa matukio ya jumla ambapo ufikiaji rahisi na salama wa huduma za Azure unahitajika bila hitaji la private IP ndani ya VNet.

Azure Front Door (AFD) & AFD WAF

Azure Front Door ni njia ya kuingia inayoweza kupanuka na salama kwa ajili ya utoaji wa haraka wa web applications zako za kimataifa. Inachanganya huduma mbalimbali kama application acceleration, SSL offloading, na application layer security (kupitia Web Application Firewall - WAF). Imejengwa kwa kanuni ya edge POP (Point of Presence) maeneo duniani kote ili kupeleka applications zako karibu na watumiaji wako.

Azure Front Door inatoa mtandao uliogawanywa kimataifa wa maeneo ya edge ili route and accelerate trafiki inayoingia kuelekea web applications zako (in Azure or elsewhere), kuboresha utendaji, na kuongeza usalama.

Mfano:

• Kwa jukwaa la e-commerce la kimataifa lenye watumiaji duniani kote, Azure Front Door inaweza ku-cache static content katika maeneo ya edge na kutoa SSL offloading, kupunguza latency na kutoa uzoefu wa mtumiaji wenye mwitikio zaidi. Zaidi ya hayo, inatoa WAF kulinda applications zako dhidi ya udhaifu wa kawaida wa wavuti (kama SQL injection au XSS).

Azure Front Door pia inatoa smart load balancing kwa kupangia trafiki kwa backend iliyo karibu inayopatikana kulingana na health probes na latency, kuhakikisha utendaji na upatikana thabiti. Kwa kuingiza WAF, inasaidia kulinda dhidi ya vitisho vya kawaida vya wavuti.

Enumeration

# List Azure Front Door profiles
az afd profile list --query "[].{name:name, location:location, resourceGroup:resourceGroup}" -o table

# List AFD endpoints
az afd endpoint list --profile-name <ProfileName> --resource-group <ResourceGroupName> --query "[].{name:name, hostName:hostName, state:resourceState}" -o table

# Classic Azure Front Door (v1) profiles
az network front-door list --query "[].{name:name, resourceGroup:resourceGroup, location:location}" -o table

# Classic Azure Front Door WAF policies
az network front-door waf-policy list --query "[].{name:name, resourceGroup:resourceGroup, location:location}" -o table

# List Azure Front Door profiles
Get-AzFrontDoorCdnProfile | Select-Object Name, Location, ResourceGroupName

# List AFD endpoints
Get-AzFrontDoorCdnEndpoint -ProfileName <ProfileName> -ResourceGroupName <ResourceGroupName> | Select-Object Name, HostName, ResourceState

# Classic Azure Front Door (v1) profiles
Get-AzFrontDoor

# Classic Azure Front Door WAF policies
Get-AzFrontDoorWafPolicy -Name <policyName> -ResourceGroupName <resourceGroupName>

Azure Application Gateway na Azure Application Gateway WAF

Azure Application Gateway ni kigawaji mzigo wa trafiki ya wavuti kinachokuwezesha kusimamia trafiki kwa maombi yako ya wavuti. Inatoa kigawaji mzigo cha Layer 7, SSL termination, na uwezo wa web application firewall (WAF) katika Application Delivery Controller (ADC) kama huduma. Vipengele muhimu ni pamoja na routing inayotegemea URL, cookie-based session affinity, na secure sockets layer (SSL) offloading, ambazo ni muhimu kwa maombi yanayohitaji uwezo mgumu wa kugawa mzigo kama global routing na path-based routing.

Mfano:

Fikiria senario ambapo una tovuti ya biashara mtandaoni inayojumuisha subdomains nyingi kwa kazi tofauti, kama vile akaunti za watumiaji na usindikaji wa malipo. Azure Application Gateway inaweza ielekeza trafiki kwa seva za wavuti zinazofaa kwa msingi wa njia ya URL. Kwa mfano, trafiki kwa example.com/accounts inaweza kuelekezwa kwa huduma ya akaunti za watumiaji, na trafiki kwa example.com/pay inaweza kuelekezwa kwa huduma ya usindikaji wa malipo.
Na kulinda tovuti yako dhidi ya mashambulio kwa kutumia uwezo wa WAF.

Uorodheshaji

# List the Web Application Firewall configurations for your Application Gateways
az network application-gateway waf-config list --gateway-name <AppGatewayName> --resource-group <ResourceGroupName> --query "[].{name:name, firewallMode:firewallMode, ruleSetType:ruleSetType, ruleSetVersion:ruleSetVersion}" -o table

# List the Web Application Firewall configurations for your Application Gateways
(Get-AzApplicationGateway -Name <AppGatewayName> -ResourceGroupName <ResourceGroupName>).WebApplicationFirewallConfiguration

VNet Peering & HUB and Spoke topolojia

VNet Peering

VNet Peering ni kipengele katika Azure kinachoruhusu Virtual Networks (VNets) tofauti kuunganishwa moja kwa moja na bila mshono. Kupitia VNet peering, rasilimali katika VNet moja zinaweza kuwasiliana na rasilimali katika VNet nyingine kwa kutumia anwani za IP binafsi, kama vile zilikuwa kwenye mtandao mmoja.\

VNet Peering pia inaweza kutumika na on-prem networks kwa kuanzisha site-to-site VPN au Azure ExpressRoute.

Azure Hub and Spoke ni usanifu wa mtandao unaotumia VNet peering kuunda Hub VNet ya kati inayounganisha na nyingi za Spoke VNets. Hub kawaida ina huduma za pamoja (kama firewalls, DNS, au Active Directory) wakati spokes zinaendesha workloads za programu. Muundo huu unarahisisha usimamizi, unaongeza usalama kupitia udhibiti wa kati, na unapunguza urudufu.

Mfano:

Shirika kubwa lenye idara nyingi (Finance, HR, IT) linaweza kuunda Hub VNet with shared services kama firewalls na DNS servers. Kila idara inaweza kuwa na Spoke VNet yake inayounganishwa na Hub kupitia peering. Hii inawawezesha idara kuwasiliana kwa usalama na kutumia huduma za pamoja bila kufichua rasilimali zao kwenye mtandao wa umma.

Enumeration

# List all VNets in your subscription
az network vnet list --query "[].{name:name, location:location, addressSpace:addressSpace}" -o table

# List VNet Peerings
az network vnet peering list --resource-group <ResourceGroupName> --vnet-name <VNetName> --query "[].{name:name, remoteVnetId:remoteVirtualNetwork.id, allowForwardedTraffic:allowForwardedTraffic, allowGatewayTransit:allowGatewayTransit}"

# List Shared Resources (e.g., Azure Firewall) in the Hub
az network firewall list --query "[].{name:name, location:location, resourceGroup:resourceGroup}" -o table

# List all VNets in your subscription
Get-AzVirtualNetwork

# List VNet Peerings
Get-AzVirtualNetworkPeering -ResourceGroupName <ResourceGroupName> -VirtualNetworkName <VNetName>

# List Shared Resources (e.g., Azure Firewall) in the Hub
Get-AzFirewall

Site-to-Site VPN

A Site-to-Site VPN in Azure huanzisha muunganisho salama na wa kudumu kutoka kwenye mtandao wako wa on-premises kwenda kwenye Azure Virtual Network (VNet), ukiruhusu rasilimali kama VMs ndani ya Azure kuonekana kana kwamba ziko kwenye mtandao wako wa ndani. Muunganisho huu unaanzishwa kupitia VPN gateway ambayo inasimba trafiki kati ya mitandao yote miwili.

Example:

Shirika lenye ofisi kuu huko New York lina kituo cha data cha on-premises ambacho kinahitaji kuunganishwa kwa usalama na VNet yake katika Azure, kinachohifadhi mizigo ya kazi iliyofanyiwa virtual. Kwa kuanzisha Site-to-Site VPN, kampuni inaweza kuhakikisha uunganishaji uliosimbwa kati ya server za on-premises na Azure VMs, kuruhusu rasilimali kupatikana kwa usalama katika mazingira yote mawili kana kwamba ziko kwenye mtandao huo huo wa ndani.

Enumeration

# List VPN Gateways
az network vnet-gateway list --query "[].{name:name, location:location, resourceGroup:resourceGroup}" -o table

# List VPN Connections
az network vpn-connection list --gateway-name <VpnGatewayName> --resource-group <ResourceGroupName> --query "[].{name:name, connectionType:connectionType, connectionStatus:connectionStatus}" -o table

# List VPN Gateways
Get-AzVirtualNetworkGateway -ResourceGroupName <ResourceGroupName>

# List VPN Connections
Get-AzVirtualNetworkGatewayConnection -ResourceGroupName <ResourceGroupName>

Azure ExpressRoute

Azure ExpressRoute ni huduma inayotoa muunganisho wa kibinafsi, wa kujitolea, wa kasi kubwa kati ya miundombinu yako ya ndani (on-premises) na vituo vya data vya Azure. Muunganisho huu unafanywa kupitia mtoa huduma wa uunganishaji, ukiepuka intaneti ya umma na kutoa uaminifu zaidi, kasi kubwa zaidi, latency ndogo, na usalama wa juu zaidi ikilinganishwa na miunganisho ya kawaida ya intaneti.

Mfano:

Shirika la kimataifa linahitaji muunganisho thabiti na wa kuaminika kwa huduma zake za Azure kutokana na kiasi kikubwa cha data na hitaji la throughput kubwa. Kampuni inachagua Azure ExpressRoute kuunganisha moja kwa moja kituo chake cha data chenye miundombinu ya ndani (on-premises) na Azure, kuwezesha uhamishaji mkubwa wa data, kama vile chelezo za kila siku na uchambuzi wa data kwa wakati halisi, kwa faragha na kasi iliyoboreshwa.

Enumeration

# List ExpressRoute Circuits
az network express-route list --query "[].{name:name, location:location, resourceGroup:resourceGroup, serviceProviderName:serviceProviderName, peeringLocation:peeringLocation}" -o table

# List ExpressRoute Circuits
Get-AzExpressRouteCircuit

Marejeo

• DNS OverDoS: Are Private Endpoints Too Private?
• Azure Private Endpoint DNS configuration
• Private DNS fallback to internet

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.