azure-pentesting

该技能不是传统恶意载荷，但它向 AI 代理提供了高风险的云渗透与后渗透能力，并明确涉及凭据读取、令牌复用、提权、横向移动和持久化。其能力与宣称用途一致，因此更像高风险进攻性安全技能而非伪装窃密器；不过对代理开放此类能力本身就应视为高风险，且存在转移信任与敏感凭据处理问题。

This fragment is an explicitly malicious, end-to-end offensive guide for Azure/Entra ID reconnaissance and compromise, including user enumeration, storage exposure probing, SAS/token misuse, password spraying, and phishing/consent flows to obtain OAuth tokens. It is not appropriate as a software dependency artifact and presents a very high security risk if distributed or used.

This fragment is not benign code; it is an attacker playbook providing actionable Azure persistence and post-exploitation techniques, including reverse shells, Managed Identity token theft, credential/SAS generation, and explicit exfiltration steps plus detection-evasion guidance. If included in a published package, it materially increases attacker capability and is indicative of malicious content. No conventional source-to-sink analysis applies because the fragment is documentation/instructions rather than executable library logic.