Bypass Azure Web App Authentication with Path Traversal

This beginner-friendly lab shows how a simple path traversal flaw in an Azure App Service web app can lead to full authentication bypass. You enumerate the target with the Az PowerShell module, exploit a vulnerable file-inclusion parameter to read source code, and use Burp Suite to discover hidden directories and pages. It is a practical reminder that managed hosting does not make an application immune to classic web vulnerabilities.

On an engagement for Mega Big Tech, your team ran an Evilginx man-in-the-middle attack with a custom phishlet and captured valid company credentials. You are tasked with demonstrating the impact of that breach by reaching business critical information.

• Basic Windows command-line knowledge
• Basic web application knowledge
• Familiarity with Burp Suite

• Enumerate Azure Web Apps and hostnames using the Az PowerShell module
• Understand the role of the Kudu (SCM) companion app and Website Contributor access
• Identify and exploit a path traversal vulnerability using dot-dot-slash sequences
• Read application source code and code-behind files to disclose sensitive information
• Use Burp Suite Intruder for directory and file busting against an authenticated app
• Configure Intruder redirections and cookie handling to enumerate protected resources
• Recover hardcoded admin credentials and bypass the login to access the admin panel

Path traversal vulnerabilities are extremely common and, while they rarely give direct code execution, the information disclosure they enable can hand an attacker source code and credentials that compromise the application or other Azure services.