Az - Azure App Service & Function Apps

Az - Huduma ya Programu ya Azure & Programu za Kazi

Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

• Ikiwa unataka kuona kampuni yako ikitangazwa kwenye HackTricks au kupakua HackTricks kwa muundo wa PDF Angalia MIPANGO YA USAJILI!

• Pata bidhaa rasmi za PEASS & HackTricks

• Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee

• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Taarifa Msingi za Huduma ya Programu

Kutoka kwa nyaraka: Azure App Service ni huduma inayotumia HTTP kwa kuhifadhi programu za wavuti, REST APIs, na sehemu za nyuma za simu. Unaweza kuendeleza kwa lugha yako pendwa, iwe ni .NET, .NET Core, Java, Ruby, Node.js, PHP, au Python. Programu zinaendeshwa na kusambazwa kwa urahisi kwenye mazingira ya Windows na Linux.

Kila programu inaendeshwa ndani ya sanduku la mchanga lakini kujitenga kunategemea mipango ya Huduma ya Programu

• Programu katika safu za Free na Shared zinaendeshwa kwenye VMs zilizoshirikiwa

• Programu katika safu za Standard na Premium zinaendeshwa kwenye VMs zilizotengwa

Tafadhali kumbuka kwamba hakuna ya kujitenga huko kuzuia udhaifu mwingine wa kawaida wa wavuti (kama vile kupakia faili, au sindano). Na ikiwa kitambulisho cha usimamizi kinatumika, kinaweza kuwa na uwezo wa kuvunja ruhusa zake.

Urambazaji

# List webapps
az webapp list

## Less information
az webapp list --query "[].{hostName: defaultHostName, state: state, name: name, resourcegroup: resourceGroup}"

# Get access restrictions
az webapp config access-restriction show --resource-group <res-group> -n <name>

# Remove access restrictions
az webapp config access-restriction remove --resource-group <res-group> -n <name> --rule-name <rule-name>

# Get snapshots
az webapp config snapshot list --resource-group <res-group> -n <name>

# Restore snapshot
az webapp config snapshot restore -g <res-group> -n <name> --time 2018-12-11T23:34:16.8388367

# Restart webapp
az webapp restart --name <name> --resource-group <res-group>

# Get App Services and Function Apps
Get-AzWebApp
# Get only App Services
Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}

```bash #!/bin/bash

Get all App Service and Function Apps

Define Azure subscription ID

azure_subscription="your_subscription_id"

Log in to Azure

az login

Select Azure subscription

az account set --subscription $azure_subscription

Get all App Services in the specified subscription

list_app_services=$(az appservice list --query "[].{appServiceName: name, group: resourceGroup}" -o tsv)

Iterate over each App Service

echo "$list_app_services" | while IFS=$'\t' read -r appServiceName group; do

Get the type of the App Service

service_type=$(az appservice show --name $appServiceName --resource-group $group --query "kind" -o tsv)

Check if it is a Function App and print its name

if [ "$service_type" == "functionapp" ]; then echo "Function App Name: $appServiceName" fi done

#### Pata siri na upate ufikiaji wa nambari ya programu ya wavuti
```bash
# Get connection strings that could contain credentials (with DBs for example)
az webapp config connection-string list --name <name> --resource-group <res-group>
## Check how to use the DBs connection strings in the SQL page

# Get credentials to access the code and DB credentials if configured.
az webapp deployment list-publishing-profiles --resource-group <res-group> -n <name>


# Get git URL to access the code
az webapp deployment source config-local-git --resource-group <res-group> -n <name>

# Access/Modify the code via git
git clone 'https://<username>:<password>@name.scm.azurewebsites.net/repo-name.git'
## In my case the username was: $nameofthewebapp and the password some random chars
## If you change the code and do a push, the app is automatically redeployed

Kufikia kontena ya Docker na programu ya wavuti kupitia ssh:

# Get ssh session
az webapp create-remote-connection --subscription <SUBSCRIPTION-ID> --resource-group <RG-NAME> -n <APP-SERVICE-NAME>

## If successfull you will get a message such as:
#Verifying if app is running....
#App is running. Trying to establish tunnel connection...
#Opening tunnel on port: 39895
#SSH is available { username: root, password: Docker! }

## So from that machine ssh into that port (you might need generate a new ssh session to the jump host)
ssh root@127.0.0.1 -p 39895

Taarifa Msingi za Programu za Kazi

Azure Functions ni suluhisho lisilo na seva ambalo linakuruhusu kuandika msimbo mdogo, kudumisha miundombinu kidogo, na kuokoa gharama. Badala ya kuhangaika kuhusu kupeleka na kudumisha seva, miundombinu ya wingu hutoa rasilimali zote zilizosasishwa zinazohitajika kuendesha programu zako.

Katika portal ya Azure, ushirikiano kati ya Azure Functions na Azure API Management unarahisishwa, kuruhusu vifaa vya kazi vya kichocheo cha HTTP kuwekwa wazi kama APIs za REST. APIs zilizowekwa wazi kwa njia hii zinaelezewa kwa kutumia ufafanuzi wa OpenAPI, kutoa kiolesura cha kawaida, bila kujali lugha, kwa APIs za RESTful.

Programu za Kazi zinasaidia Kitambulisho Kilichosimamiwa.

Zaidi ya hayo, Programu ya Kazi inaweza kuwa na vipengele fulani vinavyohitaji kiwango fulani cha uwakiki, kama "admin" au "anonymously". Mshambuliaji anaweza kujaribu kupata ufikiaji wa vifaa vya kazi vinavyoruhusiwa kwa njia ya kujificha ili kuepuka vizuizi na kupata ufikiaji wa data au utendaji wenye hisia.

Uthibitishaji

# Get only Function Apps
Get-AzFunctionApp

Marejeo

• https://learn.microsoft.com/en-in/azure/app-service/overview

• https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition

Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

• Ikiwa unataka kuona kampuni yako ikitangazwa kwenye HackTricks au kupakua HackTricks kwa PDF Angalia MIPANGO YA USAJILI!

• Pata bidhaa rasmi za PEASS & HackTricks

• Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee

• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.