SpecterOps / SpecterOps/AzureHound
List tenants in az-ad collection uses different audience than the rest of the objects
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 961
- Forks
- 148
- Avg merge
- 22h 26m
- Merged PRs (30d)
- 4
Description
Summary
The az-ad collection tries to list tenants:
But the ListAzureADTenants function uses the resourceManager audience for its request:
This leads to an error when using JWT auth because the az-ad collection needs the Graph API audience.
2025-05-13T10:52:37-05:00 INF collecting azure ad objects...
2025-05-13T10:52:37-05:00 ERR unable to continue processing tenants error="invalid audience"
The rest of the collection steps in az-ad work as expected because they all have the Graph API audience.
Steps to reproduce
$env:GRAPH_JWT = (Get-AzAccessToken -ResourceUrl "https://graph.microsoft.com").Token
./AzureHound.exe --jwt $env:GRAPH_JWT --list az-ad --tenant "contoso.onmicrosoft.com" -o "./entraid.json"
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in cmd/list-azure-ad.go around lines 101-102 and compare client/tenants.go around lines 61-69 with the other az-ad collection requests. Verify the tenant-list request uses the Graph API audience, then reproduce the PowerShell JWT command and confirm az-ad lists tenants without an invalid-audience error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- api, authentication, cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100