Azure Blob Storage
Last updated
Last updated
Blob storage is used to store unstructured data (like filed, videos, audio, etc). There are three types of resources in blob storage:
Storage account - Unique namespace across Azure (can be accessed over HTTP and HTTPS)
Container in the storage account (may be multiple in a storage account) also known as the 'Folders' in the storage account
Blob in a container - Stores data. Three types of blobs - Block, append and page blobs.
A storage account has globally unique endpoints. It is very useful in enumeration too by guessing the storage account names:
Storage Accounts support RBAC. For example the 'Storage Blob Data Reader' role allows a identity to read the data inside the storage account. Other than that, storage accounts support Access keys.
By default, anonymous access is not allowed for storage accounts. However, if enabled, this allows read access to blobs or even containers to the public. We can enumerate these using Microbust:
If you have found a container that allows you to list blobs (files), you can list those files using:
It contains a blob called "blob_client.py", to access the file we can go to
If it contains a SASurl, we can use Azure Storage Explorer to connect to that container:
Get containers context
Maybe there are deleted files that we can recover. We can check for versioning using curl:
Note that we include the x-ms-versionas header because else this is not supported by Azure. If there are any hits download the file using curl:
