Azure review with large number of groups never finishes

[djcater]

Describe the bug Similar to #698, but for groups instead of users. I was reviewing a tenant with 50,000 groups using ScoutSuite 5.10.0, and running the aad service never completed (left it for an hour). After editing the code to ignore the groups, it finished fine. I believe after retrieving the list of groups, it subsequently makes more requests per group, which is why it takes so long. Similarly for users, after getting the list of users, there are subsequent requests per user.

The users issue was partially fixed in #734 by restricting to guest users, (although if you have a large number of guest users, the issue still remains).

There were no errors or exceptions. The last line of output is:

scout[32186] INFO Fetching resources for the Azure Active Directory service

And then I can see lots of HTTPS connections and requests to the Azure AD graph in Wireshark, continuing endlessly.

To Reproduce Run a command like:

python scout.py azure --no-browser --report-dir results --timestamp --all-subscriptions --user-account-browser --tenant xxx-xxx-xxx --service aad

against a tenant with tens of thousands of groups.

Additional context This was my bodge fix, which meant that the process could complete:

--- a/ScoutSuite/providers/azure/facade/aad.py
+++ b/ScoutSuite/providers/azure/facade/aad.py
@@ -37,6 +42,9 @@ class AADFacade:
             return None

     async def get_groups(self):
+        # Don't fetch groups
+        return []
         try:
             return await run_concurrently(lambda: list(self.get_client().groups.list()))
         except Exception as e:

This was running ScoutSuite 5.10.0, set up as follows:

$ virtualenv -p python3 venv
$ source venv/bin/activate
$ pip install -r requirements.txt

Python version is 3.8.2 on Ubuntu 20.04.

Hope that helps. Thanks.

[x4v13r64]

Thanks, will review.

although if you have a large number of guest users, the issue still remains

There's really no way around that though. If you have a very large amount of resources of any kind, the tool (and other tools too I'd think) may take a long time to run and could face some issues.