Merge branch 'master' of github.com:HackTricks-wiki/hacktricks-cloud

Author: carlospolop

src/pentesting-cloud/azure-security/az-services/az-sql.md

@@ -21,6 +21,8 @@ Azure SQL consists of four main offerings:
 - Private endpoints.
 - It’s also possible to restrict connections based on domain names.
 - It’s also possible to allow Azure services to access it (like to use the Query editor in the portal or to allow an Azure VM to connect).
+  - If an SQL Server has *Allow Azure services and resources to access this server* set to "Enabled", Azure will automatically create a hidden firewall rule that allows all network traffic originating from Azure to connect to the SQL Server — including resources from any tenant.
+  - This means that if you obtain valid SQL credentials, you can connect to the victim Azure SQL Server from an Azure VM inside your own attacker‑controlled tenant. [The MS docs explains this](https://learn.microsoft.com/en-us/azure/azure-sql/database/network-access-controls-overview?view=azuresql#allow-azure-services)
 
 **Authentication Methods:**
 

src/pentesting-cloud/azure-security/az-services/az-storage.md

@@ -238,7 +238,7 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
 ### Key Features
 
 - Protocol Support: SFTP works with Blob Storage accounts configured with hierarchical namespace (HNS). This organizes blobs into directories and subdirectories for easier navigation.
-- Security: SFTP uses local user identities for authentication and does not integrate with RBAC or ABAC. Each local user can authenticate via:
+- Security: SFTP can use local user identities, but it also supports Microsoft Entra ID-based access with Azure RBAC for authorization. This means access can be granted with the usual Blob Storage data-plane roles instead of creating local SFTP users. Local users can authenticate via:
   - Azure-generated passwords
   - Public-private SSH key pairs
 - Granular Permissions: Permissions such as Read, Write, Delete, and List can be assigned to local users for up to 100 containers.
@@ -250,8 +250,8 @@ Azure Blob Storage now supports the SSH File Transfer Protocol (SFTP), enabling
 - Supported Encryption: Requires Microsoft Security Development Lifecycle (SDL)-approved cryptographic algorithms (e.g., rsa-sha2-256, ecdsa-sha2-nistp256).
 - SFTP Configuration:
   - Enable SFTP on the storage account.
-  - Create local user identities with appropriate permissions.
-  - Configure home directories for users to define their starting location within the container.
+  - For local-user access, create local user identities with appropriate permissions.
+  - For local users, configure home directories to define their starting location within the container.
 
 ### Permissions
 
@@ -491,12 +491,11 @@ az-file-shares.md
 - [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)
 - [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
 - [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support)
+- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access)
 - [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key)
 - [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage)
 - [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account)
 - [https://learn.microsoft.com/en-us/cli/azure/storage/container](https://learn.microsoft.com/en-us/cli/azure/storage/container)
 - [https://learn.microsoft.com/en-us/cli/azure/storage/blob](https://learn.microsoft.com/en-us/cli/azure/storage/blob)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-