In the last years, more and more companies adopted Entra ID (Azure AD) as an identity platform for their cloud services, often using their existing on-prem AD as a source for a hybrid setup.
As a red-teamer, penetration tester, or security architect, you are probably familiar with Active Directory security concepts. Entra ID is vastly different and is built around different concepts and protocols.
This training explains how organizations use Entra ID to manage modern cloud-based or hybrid environments and what security challenges this brings. It is the result of many years of research into the protocols and internals of Entra ID. It will give you the knowledge to analyze, attack, and secure Entra ID and hybrid setups from modern attacks.
The training is technical and deep-dives into core protocols such as OAuth2 and application concepts. It includes many hands-on exercises and labs, set up as challenges, to gain access to accounts and elevate privileges.
The training covers the following topics:
The training focuses on Entra ID’s use as an identity platform. The training does not cover Azure Resource manager abuses, except the parts where it intersects with Entra ID. While a range of (open source) tools are used during the training, the goal is to provide understanding of the inner workings, not just on knowing how to run tools.
Immersive learning of concepts and techniques to understand the inner workings of Entra ID, which can be applied during Entra ID pentests and red teams in hybrid environments.
Dirk-jan Mollema is a hacker and researcher of Active Directory and Microsoft Entra (Azure AD) security. In 2022 he started his own company, Outsider Security, where he performs penetration tests and reviews of enterprise networks and cloud environments. He blogs at dirkjanm.io, where he publishes his research, and shares updates on the many open source security tools he has written over the years. He presented previously at TROOPERS, DEF CON, Black Hat and BlueHat and has been awarded as one of Microsoft’s Most Valuable Researchers multiple times.
The students should have some degree of existing knowledge of Windows, Active Directory, web based technologies such as REST API’s, and be familiar with command line based tools, virtual machines and HTTP inspection/crafting tools.
Laptop with a virtualization platform (such as VMWare) with a virtual machine that can be used for the labs in the training. The lab exercises can be done on both Windows and Linux virtual machines, having a x64 virtual machine is preferred.
The participants should prepare a virtual machine with their preferred platform and pre-install some tools, which will be indicated later by the trainer with a dedicated communication.
Trainees will receive:
Outsider Security’s training consists of different topics and modules. Each of these is given as a combination of both theoretical and hands-on practical training, where the students apply the material in online labs.
This edition of the training consists of 4 days. The following topics will be discussed during the training:
RomHack is made with 🤍 by Cyber Saiyan
Support us making a donation or becoming a member
[ Code of Conduct ]
Cyber Saiyan Ente del Terzo Settore – C.F. (FC) 97958200582 – VAT 14669161003
