iiinova — where your digital self keeps evolving

Karim El-Melhaoui

@karimscloud.bsky.social

207 followers 69 following 38 posts

Principal Security Architect & Partner at o3c.no, CloudSec Researcher, Microsoft Security MVP, CSA Norway Board Member

Posts Replies Media

Karim El-Melhaoui @karimscloud.bsky.social · 15/05/2025

My first bounty

010

Karim El-Melhaoui @karimscloud.bsky.social · 08/05/2025

Waiting… 🥲

120

Karim El-Melhaoui @karimscloud.bsky.social · 04/05/2025

I find it hard to believe that AWS charges me for having hourly data of costs in my AWS environment.

001

Karim El-Melhaoui @karimscloud.bsky.social · 03/05/2025

If you were to remove any of the users previously, it had to be done through the REST API, as the permission is inherited on the Tenant Root Group visible in the portal

100

Karim El-Melhaoui @karimscloud.bsky.social · 03/05/2025

You can now see users that have triggered the Elevated Access toggle in Azure. A simple bypass is to immediately assign the principal the same permissions at the top level management group, Tenant Root Group (tenant ID) rather than the Root scope ("/"). I still think this is an important feature.

110

Karim El-Melhaoui @karimscloud.bsky.social · 18/04/2025

Cloudy at Fløtatind, Sunndal

010

Karim El-Melhaoui @karimscloud.bsky.social · 01/01/2025

Starting the new year above the clouds

030

Karim El-Melhaoui @karimscloud.bsky.social · 30/12/2024

.. enumerating the sub-domains using subfinder. Following the sub-domain enumeration, the endpoints were further enumerated using GoBuster. GoBuster revealed a Java Spring application with the Actuator endpoint enabled. The Actuator endpoint revealed an AWS Access Key and Heapdumps..

130