Multi-surface pivot
A real pentester who owns app.example.com rarely stops at the web app. They look at the domain’s cloud identity surface: Entra ID tenant shape, federation, AWS account posture when keys exist, Workspace when a service account is available.
Pentestas supports the same pivot pattern from:
- the hybrid AI workbench agent (
surface_status,pivot_azure_recon,pivot_aws_audit), and - dedicated Azure, cloud storage, and Google Workspace scan families.
Surface assessment
For a given web target URL + optional cloud_config, the platform can report:
| Pivot | Available when | Notes |
|---|---|---|
| Azure black-box recon | Public domain resolvable | Domain only — no password spray |
| Azure authenticated | SP / token / tenant config on scan | Full read-oriented ARM + Graph style audit |
| AWS audit | Access keys / profile / role on scan | SecurityAudit-style checks; never invents keys |
| Google Workspace | Service account JSON on scan | Admin SDK checks |
If credentials are missing, the pivot returns “not available” instead of guessing.
Azure black-box recon (recon_only)
Agent-driven Azure pivots use recon_only=true:
- Tenant ID discovery, federation / hybrid indicators, public service fingerprints.
- No password spray, MFA flooding, or account lockout risk.
- Findings are capped and labelled as recon-oriented.
For deep authenticated Azure CIS / IAM work, start a dedicated Azure subscription scan with a Reader (or stronger) Service Principal.
AWS pivot
Runs only when the scan already carries AWS credentials (access key + secret, profile, or role ARN). Without them, pivot_aws_audit fails closed with a clear error — the agent will not prompt you for keys mid-flight in a way that stores secrets outside scan config.
Prefer a dedicated cloud scan for multi-region, scheduled, or CI-driven AWS audits.
How this shows up in a hybrid web scan
- Web modules run against
https://app.example.com. - Workbench agent investigates HIGH/CRITICAL web leads with History / Forge / Volley / OAST.
- If the domain warrants it, the agent calls
surface_statusthenpivot_azure_recon(and AWS if keys exist). - Cloud findings join the same scan’s finding list with Azure/AWS-oriented titles and evidence.
Safety and honesty
- No invented credentials. Missing secrets → skip pivot.
- No spray from the agent path. Azure black-box agent pivot is recon-only.
- Scope still applies to HTTP workbench traffic; cloud APIs use the credentials you attached to the scan.
- Authorisation remains yours — only scan domains and cloud accounts you are allowed to test.