Skip to content

Releases: TacoRocket/AzureFox

1.5.0 - Grouped Chains And DevOps Proof

18 Apr 20:06
@github-actions github-actions
v1.5.0
7fe44a5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
1.5.0 - Grouped Chains And DevOps Proof Latest
Latest

v1.5.0 - grouped chains and DevOps proof

v1.5.0 is where grouped chains gets a lot more usable live, and where devops / chains deployment-path starts pulling real Azure Repos pipeline evidence into the picture instead of leaving that whole story trapped in YAML.

What shipped:

  • YAML-backed Azure DevOps pipeline evidence, so devops and chains deployment-path can now surface repo-backed Azure service connections and variable groups from real pipeline definitions and same-repo local templates instead of making you go prove that by hand
  • strict grouped chains artifact reuse for compatible local source JSON, so repeat family reruns can reuse evidence that already exists instead of recollecting the same backing commands every time
  • batched role-trusts Graph fanout, which speeds up trust-edge collection and carries forward into grouped chains families that depend on the same trust reads
    In testing, the same trust-edge collection dropped from around 342 seconds to as low as 24 seconds depending on the environment, which worked out to roughly a 78.6% to 93% reduction in time.
    That carried forward into grouped chains runs too:
    escalation-path dropped from 26 seconds to 2 seconds, about 16x faster and roughly 93% less time.
    deployment-path dropped from 38 seconds to 1.62 seconds, about 23x faster and roughly 95% less time.
    compute-control dropped from 19 seconds to 1.6 seconds, about 11.8x faster and roughly 91.6% less time.
  • tighter reduced-view and maintenance-mode truthfulness across permissions, tokens-credentials, credential-path, deployment-path, functions, arm-deployments, and resource-trusts, so partial visibility reads as partial visibility instead of sounding like stronger proof than the run actually earned

Project note:
AzureFox is moving into maintenance mode from here. If people find issues that are real blockers for usage or that break the tool against its current expectations, those will still get fixed and patched.

The bigger push from here is going into the Go rewrite in HarrierOps Azure.

Assets 4
Loading

1.4.0 - Compute-control chain added

13 Apr 02:31
@TacoRocket TacoRocket
v1.4.0
8d80986
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
1.4.0 - Compute-control chain added

Compute-control chain added

v1.4.0 is a big step for AzureFox because it closes the gap between flat reconnaissance and defended operator follow-on. This release ships the new compute-control chain family plus first-class container-apps and container-instances commands, so container-heavy environments are now visible both as direct inventory and as joined control-path opportunities. In practice, that means AzureFox can do more of the "what can I reach from here, and why does it matter?" work in one pass instead of making the operator stitch it together manually.

priority  when     reach from here                compute foothold  token path             identity             Azure access                         proof status
high      act now  public exposure visible;       app-empty-mi      service token request  app-empty-mi-system  Contributor across subscription-wide confirmed
                    exploitation not proved                                                                   scope

note
AppService 'app-empty-mi' can request tokens as app-empty-mi-system; that identity already maps to Contributor across subscription-wide scope. To turn this into downstream Azure access, an operator would need server-side execution in this public-facing service. AzureFox is a recon tool and does not verify exploitation activity beyond what is explicitly stated here.

What's Changed

  • docs: sharpen positioning and retire planning notes by @TacoRocket in #84
  • test: cover vms and snapshots flows by @TacoRocket in #85
  • deps: update pytest-cov requirement from <6,>=5.0 to >=5.0,<8 by @dependabot[bot] in #66
  • tighten credential-path proof boundaries by @TacoRocket in #86
  • Harden deployment-path actionability by @TacoRocket in #87
  • deps: update azure-mgmt-network requirement from <27,>=26.0 to >=26.0,<31 by @dependabot[bot] in #35
  • fix: harden deployment path joins and docs by @TacoRocket in #88
  • Align chain wording and issue scope contract by @TacoRocket in #89
  • deps: update azure-mgmt-resource requirement from <24,>=23.1 to >=23.1,<26 by @dependabot[bot] in #33
  • Tighten chain-family output wording and proof boundaries by @TacoRocket in #90
  • Finish deployment-path slice by @TacoRocket in #91
  • Refine compute-control mixed identity paths by @TacoRocket in #93
  • Add container workload coverage and tighten compute-control by @TacoRocket in #94
  • Refine chains README blurbs by @TacoRocket in #95
  • chore: prepare v1.4.0 release by @TacoRocket in #96

Full Changelog: v1.3.0...v1.4.0

Contributors

TacoRocket and dependabot
Loading

1.3.0 - Credential-path chain shipped

09 Apr 04:05
@github-actions github-actions
v1.3.0
351a4c9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
1.3.0 - Credential-path chain shipped

Credential-path chain shipped

v1.3.0 is where AzureFox's chain views became a real shipped workflow instead of just supporting clues. This release landed the reusable chain plumbing, shipped credential-path, and tightened the wording and proof boundaries so the tool could start showing defended follow-on paths without overstating what the current access proved.

What's Changed

Full Changelog: v1.2.0...v1.3.0

Contributors

TacoRocket
Loading

1.2.0 - Phase 4 service lane completed

05 Apr 19:53
@github-actions github-actions
v1.2.0
50d1f73
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
1.2.0 - Phase 4 service lane completed

Phase 4 service lane completed

v1.2.0 closed the first Azure-native service expansion wave for AzureFox. This is the release where the tool grew beyond the initial core recon surface and started covering more of the operator's real Azure follow-on space with shipped snapshots-disks, vmss, lighthouse, cross-tenant, automation, and devops command coverage.

What's Changed

Full Changelog: v1.1.0...v1.2.0

Contributors

TacoRocket
Loading

1.1.0 - First grounded depth tranche added

04 Apr 17:29
@github-actions github-actions
v1.1.0
70e35ba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
1.1.0 - First grounded depth tranche added

First grounded depth tranche added

v1.1.0 was the first release that pushed AzureFox past simple presence reporting and into richer operator-facing depth. Existing commands started surfacing more meaningful posture, ranking, and follow-up value across ACR, databases, DNS, storage, AKS, and network-effective so the tool could better answer what deserves attention first.

What's Changed

New Contributors

Full Changelog: v1.0.0...v1.1.0

Contributors

TacoRocket and dependabot
Loading

1.0.0 - AzureFox launched

02 Apr 22:57
@TacoRocket TacoRocket
v1.0.0
e676ad0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
1.0.0 - AzureFox launched

AzureFox launched

v1.0.0 is the first public AzureFox release boundary. It established the core offensive Azure recon surface across identity, privilege, secrets, workloads, network, storage, apps, APIs, and databases, along with the packaging and release path needed to ship the tool as a real installable product.

What's Changed

New Contributors

Full Changelog: https://github.com/TacoRocket/AzureFox/commits/v1.0.0

Contributors

TacoRocket
Loading