Watch the stream
Serverless architectures continue to evolve and so does their attack surface. Azure Function Apps have undergone a significant architectural transformation with the introduction of the Flex Consumption plan, identity-based service connections, private networking, OpenAI integrations, and hybrid hosting models. While these features expand functionality and scalability, they also introduce new and often overlooked security misconfigurations.
Azure Functions remain a powerful serverless compute platform capable of interacting with a wide range of cloud and on-premises services. However, recent platform enhancements have created novel abuse primitives that can be leveraged by attackers for persistence, lateral movement, and stealthy post-exploitation operations.
This talk explores modern techniques for gaining access to Azure Function App source code and configuration data across contemporary deployment models, including Flex Consumption and container-backed hosting. We demonstrate how identity-based service connections, managed identities, and Key Vault or App Configuration references can be abused to access downstream cloud resources without relying on traditional secrets. We also present new approaches for deploying stealthy backdoors across multiple runtimes, including .NET isolated, Python, Node.js, and Java. Additionally, we examine authenticated Function App misconfigurations that allow unintended user access and execution.
We further analyze advanced networking scenarios enabled by recent platform features such as VNet-integrated serverless functions and private triggers and show how they can be exploited to pivot between cloud and internal environments. The talk also highlights how Azure Function Apps can be repurposed as resilient command-and-control redirectors or staging infrastructure, blending seamlessly into legitimate serverless traffic and cloud telemetry.
Through updated real-world penetration testing case studies, we demonstrate modern escalation paths originating from Function Apps that lead to privileged Azure control and hybrid identity compromise. By uncovering these feature-driven abuse cases and providing actionable detection and hardening guidance, this research equips both defenders and cloud pentesters to secure the next generation of Azure serverless deployments.
Chirag Savla , White Knight Labs
Chirag Savla is a cyber security professional with 10+ years of experience. His areas of interest include penetration testing, red teaming, azure and active directory security, and post-exploitation research. For fun, he enjoys creating open-source tools and exploring new attack methodologies in his leisure. Chirag has worked extensively on Azure, Active Directory attacks and defense, and bypassing detection mechanisms. He is the author of multiple open source tools such as Process Injection, Callidus, and others. He has presented at many conferences and local meetups and has trained people in international conferences like Blackhat, BSides Milano, Wild West Hackin’ Fest, HackSpaceCon, VulnCon and NorthSec.