Azure

The challenge provides Client Credentials that are used to identify the Tenant ID, then using that to request an Access Token that we can use to authenticate and enumerate the API Permission assigned to the Application

The challenge is a webapp that has a Command Injection vulnerability, the goal is to exploit the vulnerability by making an internal request to the Azure instance and extract the access token to authenticate then retrieve the Azure Subscription ID which is the flag