Karl Fosaaen
VP, Research
Connect With Me on Social
Bluesky
X/Twitter
My GitHub Repo
More By Karl Fosaaen
Extracting Sensitive Information from Azure Load Testing
Learn how Azure Load Testing's JMeter JMX and Locust support enables code execution, metadata queries, reverse shells, and Key Vault secret extraction vulnerabilities.
Validating Azure Cloud Security with Breach and Attack Simulation as a Service
NetSPI’s Breach and Attack Simulation as a Service offers focused simulation tests for Azure users to validate your cloud security capabilities.
Hijacking Azure Machine Learning Notebooks (via Storage Accounts)
Abusing Storage Account Permissions to attack Azure Machine Learning notebooks
Backdooring Azure Automation Account Packages and Runtime Environments
Azure Automation Accounts can allow an attacker to persist in the associated packages that support runbooks. Learn how attackers can maintain access to an Automation Account.
Extracting Managed Identity Certificates from the Azure Arc Service
The Azure Arc service is handy for bringing on-prem systems to the cloud, but it includes features that could lead to pivots from on-prem into your Azure environment.
Security Magazine: Closing the cloud skills gap as adoption grows
NetSPI's VP of Research, Karl Fosaaen, weighs in on addressing the cybersecurity skills gap to avoid data security risks during cloud migrations.
Azure Deployment Scripts: Assuming User-Assigned Managed Identities
Learn how to use Deployment Scripts to complete faster privilege escalation with Azure User-Assigned Managed Identities.
Extracting Sensitive Information from the Azure Batch Service
The added power and scalability of Batch Service helps users run workloads significantly faster, but misconfigurations can unintentionally expose sensitive data.
Automating Managed Identity Token Extraction in Azure Container Registries
Learn the processes used to create a malicious Azure Container Registry task that can be used to export tokens for Managed Identities attached to an ACR.
Mistaken Identity: Extracting Managed Identity Credentials from Azure Function Apps
NetSPI explores extracting managed identity credentials from Azure Function Apps to expose sensitive data.
Azure Cloud Security Pentesting Skills
At Black Hat, NetSPI VP of Research Karl Fosaaen sat down with the host of the Cloud Security Podcast Ashish Rajan to discuss all things Azure penetration testing. Give the video a watch and then head over to NetSPI's Azure Penetration Testing service to learn more.
Escalating Privileges with Azure Function Apps
Explore how undocumented APIs used by the Azure Function Apps Portal menu allowed for directory traversal on Function App containers.