azureOutlookC2

Azure Outlook C2 Azure Outlook Command & Control, использующий Microsoft Graph API для C2-коммуникаций и эксфильтрации данных. Удалённое управление скомпрометированным устройством Windows через ваш почтовый ящик Outlook. Создатели: Bobby Cooke @0xBoku и Paul Ungur @C5pider Обновление CTI-угроз...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

reportly

Reportly — это инструмент для отчётов о активности пользователей EntraID. О инструменте Это инструмент, который поможет командам Blue во время облачного инцидента. При запуске инструмента исследователь вводит подозрительного пользователя и временной интервал и получает отчёт, содержащий следующее...

ConditionalAccessDocumentation

PowerShell을 사용한 조건부 액세스 문서화 이 PowerShell 스크립트는 Microsoft Entra 조건부 액세스 정책을 문서화합니다. 스크립트는 모든 데이터를 csv 파일로 내보내며, 이를 엑셀 통합 문서로 예쁘게 포맷할 수 있습니다. 모든 정책을 검색하고 문서화할 수 있도록 스크립트는 Microsoft Graph Beta API 엔드포인트를 사용합니다. 설치 및 사용 1. PowerShell 갤러리에서 이 스크립트를 설치합니다종속 Microsoft.Graph.Authentication 모듈이 자동으로 설치됩니다...

M365Pwned

M365Pwned Microsoft Graph API를 통한 Microsoft 365 공격에 사용되는 Red Team 도구입니다. 애플리케이션 수준 OAuth 토큰을 사용하여 M365 환경의 데이터를 열거, 검색, 외부 유출exfiltration하기 위한 두 개의 WinForms GUI 도구입니다 — 사용자 상호 작용이 필요 없습니다. 도구| 대상| 기능 ---|---|--- MailPwned-GUI.ps1| Exchange Online / Outlook| 사서함 탐색, 메일 검색, 첨부 파일 다운로드,...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

TokenMan

액세스 및 리프레시 토큰 스위트. Token Man은 AAD 액세스 및/또는 리프레시 토큰을 사용하여 침투 후post-exploitation 활동을 지원하는 도구입니다. 목차 사용법 명령어 Fetch Search Swap FOCI 애플리케이션 클라이언트 ID 맵 AZ OAuth 사용법 root@kitploit: usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -- v0.1.1 positional arguments: fetch,search,swap,az,oauth...

GraphStrike

GraphStrike Блог о релизе: GraphStrike: Использование Microsoft Graph API для исчезновения трафика Beacon Блог разработчика: GraphStrike: Анатомия разработки наступательных инструментов Введение GraphStrike — это набор инструментов, который позволяет HTTPS Beacon от Cobalt Strike использовать...

CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 우리는 테러 조직 하마스에 의해 인질로 잡힌 모든 시민의 안전한 귀환을 요구합니다. 모든 인질이 석방되어 안전하게 귀환할 때까지 우리는 쉬지 않을 것입니다. 여러분도 그들을 집으로 데려오는 데 도움을 줄 수 있습니다.https://stories.bringthemhomenow.net/ CVE-2023-49103 익스플로잇 배경 ownCloud는 엔터프라이즈 환경을 위해 설계된 파일 공유 플랫폼입니다. 2023년 11월 21일, ownCloud는 "Graph...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — 메타 피싱Meta-Phishing Facebook Graph API — OAuth 토큰 재사용 및 세션 하이재킹...

CVE-2026-18056

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

EUVD-2026-72043

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-25703 Potential information leakage from manager /network/graph API in NeuVector

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information...

CVE-2026-25703

NeuVector up to version 5.4.9 potentially leaks information from the manager, specifically via the /network/graph API, due to missing authentication and cached data containing sensitive information. Affected component: NeuVector manager API surface; vulnerability arises from insufficient access c...

EUVD-2026-41876

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...

Access Control Bypass

Overview pycti is a Python API client for OpenCTI. Affected versions of this package are vulnerable to Access Control Bypass via the userEdit process in the graphQL API. An attacker can gain unauthorized access to sensitive information and perform actions with elevated privileges by adding a user...

Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-chfm-xgc4-47rj. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Gra...

GHSA-8PF2-VJ79-4WXG Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-chfm-xgc4-47rj. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Gra...