Networking in Azure

Our goal in this section is to describe how PowerShell can be used with Azure to perform network reconnaissance and profiling as part of a penetration test. Our goal is to use this information to construct a network map. Once we have a public IP address and name, we can start to use nslookup to explore the type of DNS services:

PS C:\> nslookup devtest.snowcapcyber.com
Server:          192.168.1.254
Address:    192.168.1.254#53
Non-authoritative answer:
devtest.snowcapcyber.com    canonical name = snowcapcyber.z13.web.core.windows.net.
snowcapcyber.z16.web.core.windows.net    canonical name = web.s768fd45.store.core.windows.net.
Name:    web.s768fd45.store.core.windows.net
Address: 52.239.123.45

From the analysis of the DNS names, we can identify the type of service. The following table lists the available DNS suffixes:

...