Blob Storage

Blob storage is used to store unstructured data (like files, videos, audio etc.) There three types of resources in blob storage:

– Storage account - Unique namespace across Azure. Can be accessed over HTTP or HTTPS.

– Container in the storage account - 'Folders' in the storage account

– Blob in a container - Stores data. Three types of blobs - Block, Append and Page blobs.

A storage account has globally unique endpoints.

Storage Service	Endpoint
Blob storage	https://.blob.core.windows.net
Azure Data Lake Storage Gen2	https://.dfs.core.windows.net
Azure Files	https://.file.core.windows.net
Queue storage	https://.queue.core.windows.net
Table storage	https://.table.core.windows.net

There are also multiple ways to control access to a storage account, including Entra ID credentials, share key, and shared access signatures. By default, anonymous access is not allowed for storage accounts. If 'Allow Blob public access' is allowed on the storage account, it is possible to configure anonymous/public read access to Only the blobs inside containers (listing of container content is not allowed) or contents of container and blobs.

Storage explorer is a standalone desktop app to work with Azure storage accounts. It is possible to connect using access keys, SAS urls etc.

1

Add target specific permutations

add permutations like common, backup, code to the 'permutations.txt' in C:\AzAD\Tools\Microburst\Misc to tune it for your target.

2

Run MicroBurst

C:\AzAD\Tools\MicroBurst\Misc\Invoke-EnumerateAzureBlobs.ps1
Invoke-EnumerateAzureBlobs -Base defcorp

3

Access found containers

will be an URL, for example https://defcorpcommon.blob.core.windows.net/backup?restype=container&comp=list.

4

Locate blob name

Look for the blob name potentially between the <Name> tag. Add this name to the URL, for example: https://defcorpcommon.blob.core.windows.net/backup/blob_client.py

5

If you get a blank page

Crtl+F5

6

Look for information

Be on the lookout for access keys, SAS urls among any secrets or information that could be there. This data can basically be anything. Use Azure Storage Explorer if you do find access keys or SAS urls.