f

Author: carlospolop

src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md

@@ -355,7 +355,7 @@ curl http://169.254.169.254/metadata/v1.json | jq
 >
 > Therefore, to find all the attached MIs you can do:
 >
-> - Get **attached identities with az cli** (if you have already compromised a principal in the Azure tenant)
+> - Get **attached identities with az cli** (if you have already compromised a principal in the Azure tenant with the permission `Microsoft.Compute/virtualMachines/read`)
 >
 > ```bash
 > az vm identity show \
@@ -386,7 +386,7 @@ curl http://169.254.169.254/metadata/v1.json | jq
 >  "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Compute/virtualMachines/$VM_NAME?api-version=$API_VERSION" | jq
 > ```
 >
-> - **Get all** the defined managed identities in the tenant and **brute force** to see if any of them is attached to the VM:
+> - **Get all** the defined managed identities in the tenant and **brute force** to see if any of them is attached to the VM (the permission `Microsoft.ManagedIdentity/userAssignedIdentities/read` is needed):
 >
 > ```bash
 > az identity list