Penetration testing Azure for ethical hackers (book review)

What it is

A completed-cover-to-cover review of Packt's Penetration Testing Azure for Ethical Hackers (Okeyode & Fosaaen, Sept 2021, 332pp). Beyond the verdict ("good starting point, not a bible"), the review carries specific fixes for the book's hands-on labs that a reader will otherwise hit blind.

What to do

If you deploy the lab range on the free Azure plan (€200 credit), the reviewer found no VMs available in the book's stated zones. The workaround:

• Allocate the pentest VM in any available location (reviewer got Japan East).
• Allocate the exercise hosts in a different available location (reviewer got East Asia).
• In each .ps1 exercise script, set the location variable to that value, e.g. eastasia.

Chapter 7 labs: the setup script fails because it does not assign the global administrator role to the demo user. Fix: manually add the role to the user in the Azure portal (the reviewer also filed a pull request).

Chapter 8 labs: to get the Az module installed and working on the victim VM, follow this thread:

https://stackoverflow.com/questions/43323123/warning-unable-to-find-module-repositories

Worth knowing before committing

• Chapters follow an attacker methodology (least-privileged reader → contributor on IaaS/PaaS → owner/Azure AD → persistence) and are meant to be read in order; later chapters reference earlier ones.
• Every attack was retested and confirmed still relevant as of the review; each includes mitigation/detection guidance, so it is usable defensively, not just offensively.
• No prior Azure security experience is required, though some helps.
• Time investment: ~3 weeks at 1–3 hrs/day on evenings and weekends.

Caveats

The reviewer's stated headline value is the methodology, not the tooling — something they argue you cannot assemble from Microsoft docs alone. If you already have hands-on Azure attack experience and a mentor network, that core value proposition is weaker for you.