Go365

Go365 v2.0 AWS Gatewayの問題を修正（h0useh3ad氏に感謝！） プロキシサーバー接続が失敗しても停止しなくなりました graphエンドポイントを追加 Go365を使用する前に、このREADMEをすべてお読みください！ Go365は、Office365（現在/間もなくMicrosoft365）を使用する組織に対するユーザー列挙およびパスワード推測攻撃を実行するために設計されたツールです。Go365は、他のほとんどのツールが使用しないlogin.microsoftonline.com上の独自のSOAP...

spraycharles

Spraycharles やあ、俺はスプレー・チャールズみたいな気分だ - Chiddy Bang 低くゆっくりとしたパスワードスプレー攻撃ツール。長期間にわたって間隔を置いてスプレーするように設計されています。 以下のスプレー用プラグインを含みます: Office365, OWA, EWS, Okta, ADFS, Cisco SSL VPN, Citrix Netscaler, Sonciwall, NTLM over HTTP, SMB。 関連ブログ記事: NTLM over HTTP、Exchange Web Services、Spraycharlesについての記事 by...

UhOh365

UhOh365 Office365でメールアドレスが有効かどうかを確認できるスクリプトです。ログイン試行は一切行わず、レート制限もなく、ソーシャルエンジニアリング評価において、どのメールが存在し、どのメールが存在しないかを調べるのに非常に役立ちます。 Microsoftは「メール列挙」を脆弱性とは見なしていないため、これは「機能」を利用したものです。他にもいくつか公開されているOffice365メール検証スクリプトがありますが、（私が見た限りでは）すべて少なくとも1回のログイン試行をユーザーアカウントごとに必要とします。それは検出可能...

oauthseeker

OAuthSeeker OAuthSeeker 是一款红队工具，用于通过恶意 OAuth 应用程序执行钓鱼攻击，以危害 Microsoft Azure 和 Office365 中的用户身份。 🚀 主要功能 OAuthSeeker 提供以下核心功能： Azure App OAuth 钓鱼： 针对 Microsoft Azure 和 Office365 用户执行 OAuth 钓鱼攻击，以获取 Microsoft Graph API 和 Microsoft Azure 资源的访问权限。 管理控制面板 ：提供管理控制面板，默认在 localhost 接口上可访问，并默认启用身份验证。 令牌刷新器...

decode-spam-headers

decode-spam-headers.py 无论你是想在日常管理工作中弄清楚某封特定电子邮件为何会进入垃圾邮件/垃圾邮件文件夹，还是为了红队钓鱼模拟的目的，这个脚本都能帮到你！ 这个想法产生于一次针对配备 MS Defender for Office365 的 MS Office365 E5 环境开展商业钓鱼模拟演练的过程中。可以想象，从钓鱼模拟的角度来看，这是一个相当棘手的安全技术栈。 在手动翻阅所有这些 Office365 SMTP 邮件头并试图从中挑选出 SCL 值之后，是时候编写一个像样的 SMTP 邮件头解析器了。 时光荏苒，我不断为越来越多的 SMTP...

EUVD-2017-3883

Malware in sbrugna...

CVE-2024-36464 Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...

"BingBang" flaw enabled altering of Bing search results, account takeover

Researchers from Wiz have discovered a way to allow for search engine manipulation and account takeover. The research in question focuses on several Microsoft applications, with everything stemming from a new type of attack aimed at Azure Active Directory. Azure Active Directory is a single sign-...

SecureMail: Modern Authentication doesn't work - "Incorrect user name or password"

You get the error"Incorrect user name or password" when trying to login your Office365 mailbox using Securemail When Securemail Network Access is set to Unrestricted the user is able to authenticate and synchronize emails properly...

What’s New in InsightIDR: Q4 2022 in Review

As we continue to empower security teams with the freedom to focus on what matters most, Q4 focused on investments and releases that contributed to that vision. With InsightIDR, Rapid7’s cloud-native SIEM and XDR solution, teams have the scale, comprehensive contextual coverage, and expertly vett...

Voicemail Scam Steals Microsoft Credentials

Attackers are using an oft-used and still effective lure to steal credentials to key Microsoft apps by sending emails notifying potential victims that they have a voicemail message, researchers have found. A team from Zscaler ThreatLabZ has been monitoring a campaign since May that targets key...

CVE-2021-43458

An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the 1 hsflowd, 2 VembuBDR360Agent, or 3 VembuOffice365Agent service paths...

“FudCo” Spam Empire Tied to Pakistani Software Firm

In May 2015, KrebsOnSecurity briefly profiled "The Manipulaters," the name chosen by a prolific cybercrime group based in Pakistan that was very publicly selling spam tools and a range of services for crafting, hosting and deploying malicious email. Six years later, a review of the social media...

How to Configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider

This article describes how to configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider and this article also provides detailed steps to configure Windows Azure to use NetScaler as a Security Token Service STS/ Identity Provider IDP...

OneDrive Sync Provider Enumeration Module

This module will identify the Office 365 OneDrive endpoints for both business and personal accounts across all users providing access is permitted. It is useful for identifying document libraries that may otherwise not be obvious which could contain sensitive or useful information. Module Options...

UhOh365 - A Script That Can See If An Email Address Is Valid In Office365 (User/Email Enumeration)

A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerability, so th...

Go365 - An Office365 User Attack Tool

Go365 is a tool designed to perform user enumeration and password guessing attacks on organizations that use Office365 now/soon Microsoft365. Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the...

Digitally Signed Bandook Trojan Reemerges in Global Spy Campaign

A wave of targeted cyberattack campaigns bent on espionage is cresting around the globe, using a strain of a 13-year old backdoor trojan named Bandook. According to Check Point Research, Bandook was last spotted being used in 2015 and 2017/2018, in the “Operation Manul” and “Dark Caracal”...

STRONTIUM: Detecting new patterns in credential harvesting

Microsoft has tied STRONTIUM to a newly uncovered pattern of Office365 credential harvesting activity aimed at US and UK organizations directly involved in political elections. Analysts from Microsoft Threat Intelligence Center MSTIC and Microsoft Identity Security have been tracking this new...

Fake Zoom meeting invitation phishing scam harvests Microsoft credentials

By Sudais Asif Initially targeting Zoom users; the phishing scam aims for Outlook and Office365 credentials. This is a post from HackRead.com Read the original post: Fake Zoom meeting invitation phishing scam harvests Microsoft credentials...