Epic Pentest Fail

A penetration test narrative describes discovering exposed keys leading to Entra app secrets, using BloodHound/AzureHound to map a path to Global Admin and successfully escalating privileges; during cleanup, a PowerShell escaping mistake in a Microsoft Graph DELETE to `directoryRoles/.../members/$ref` deleted the service principal instead of removing GA membership, necessitating recovery via `deletedItems/restore`. The post highlights relevant cloud TTPs (app credential abuse, role membership manipulation), operational risks, and lessons for safer API use and design (avoid special characters in URLs, adhere to SRP), emphasizing careful syntax validation and preferring shells that handle `$ref` correctly.