Gathering an inventory of resources

After gaining access to an Azure AD account with the Reader role applied, our first step should be enumeration. We will want to know what we are working with and what additional exposures may exist in the external environment.

In our earlier enumeration examples, we relied on wordlists and brute-force enumeration to find Azure services that might be in a subscription. With Reader access, we can poll all the available services to gather a definitive list of resources with an internal and external attack surface area.

In this section, we will show an easy way to quickly enumerate all of the available resources in an Azure subscription, using built-in functionality in the Azure portal. This is a great way to keep track of assets that you are testing during an engagement:

1. Log in to the portal as the readeruser account.
2. Navigate to the All resources blade:

   Figure 4.9 - The All resources blade

3. Select Export to CSV from the top menu...