AzureRedOps

AzureRedOps A Swiss Army tool for Azure / Entra ID red teaming. Author: Mr.Un1k0d3r TrueCyber Inc Version: 0.1 Language: Python 3.12+ Overview AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team...

EUVD-2026-70798

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...

hawk

Hawk Documentation and Resources Visit hawkforensics.io for comprehensive documentation including: Detailed installation and permissions guides Step-by-step tutorials and "How to" videos Troubleshooting help Best practices and usage examples What is Hawk? Hawk is a free, open-source PowerShell...

OutOfTune

OutOfTune Inspired by the original Pytune, OutOfTune registers a rogue device in Entra ID, enrolls it into Intune MDM, and checks the resulting compliance state. Only supports Windows devices as this was my main goal, might add additional ones in the future. Accompanying blog:...

CVE-2026-62916

CVE-2026-62916 is an authentication bypass in Microsoft Entra ID that allows an unauthorized attacker to elevate privileges over a network via an alternate path or channel. The vulnerability is rated CVSS 9.1 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, meaning it is exploitab...

EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

apimspray

apimspray apimspray is a specialized Entra ID Passwordspraying Toolkit designed for authorized security research and Red Teaming. It utilizes Azure API Management APIM gateways as a distributed, rotating proxy layer for IP Rotating. Read Blog Post for more Details about this project Prerequisites...

CredSpy

CredSpy Enumerate Microsoft Entra ID authentication methods for email addresses using the public GetCredentialType API. This is the same endpoint the Microsoft login page uses when you enter a username. In contrast to most tools using the GetCredentialType method, CredSpy also shows the...

ConditionalAccessDocumentation

توثيق الوصول الشرطي باستخدام PowerShell يقوم هذا السكربت المكتوب بلغة PowerShell بتوثيق سياسات الوصول الشرطي Conditional Access في Microsoft Entra. يقوم السكربت بتصدير جميع البيانات كملف CSV يمكن تنسيقه بشكل جميل كدفتر عمل Excel. لضمان إمكانية استرداد وتوثيق جميع السياسات، يستخدم السكربت نقطة نها...

TokenFlare

TokenFlare Serverless AITM Phishing Simulation Framework for Entra ID / M365 Features Lean: Core logic in src/worker.js only 530 lines of JavaScript. Modular: Supports a number of OAuth flows, with Intune Conditional Access bypass support out of the box Easily tweaked: Set up client branding, URL...

CVE-2025-59501

CVE-2025-59501 POC that abuses SCCM's AdminService API when Entra ID integration is enabled to elevate to Full Administrator and takeover an SCCM hierarchy. More details can be found in this blog Requirements uv Install root@kitploit: git clone https://github.com/garrettfoster13/CVE-2025-59501.gi...

SecretsStalker

secretstalker / / / / / / / / / / / \ / - / - -/ /\ \ / / // / ' / -/ / // // / / / / /, /// /\// root@kitploit: ╔╦╦╬╬╬╬╬╬╦╦╗ ╔╬╬╬╝╝┘ ╚╝╝╬╬╬┐ ╬╬╝╚╩╬╗╔ ╚╬╬╬ ╬╝ ╚╬╬╗╗ ╔ ╚╬╗ ╬╬ ╔╗ ╚╬╬╬╬╬╬╦ ╬╬ we found your secret... ╔╬┤ ╬╬╬ ╬╬╬╬╬╬╬╬╝╝╝╬╬╗ ...now let's see what it ╬╬┤ ╚╩┘ ╚╬╬╬╬╬╩ ╠╬╬ can REALLY do...

BadZure

BadZure BadZure is a Python tool that automates the creation of misconfigured Azure environments, enabling security teams to simulate adversary techniques, develop and test detection controls, and run purple team exercises across Entra ID and Azure infrastructure. It uses Terraform to populate...

MAAD-AF

MAAD Attack Framework MAAD-AF is an open-source cloud attack tool for Microsoft 365 & Entra IDAzure AD environments. MAAD-AF offers simple, fast and effective security testing. Validate Microsoft cloud controls and test detection & response capabilities with a virutally zero-setup process, comple...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

CloudSec

Cloud Security Toolkit The Art of Cloud Exploitation Welcome to the Cloud Security Toolkit—a specialized resource designed for offensive security researchers, red teamers, and adversaries. This repository is dedicated to the systematic weaponization of vulnerabilities, advanced attack simulations...

CacheData_decrypt

CacheDatadecrypt أداة بسيطة لتنفيذ التخمين القسري Brute Force وفك تشفير CacheData الخاص بـ Windows EntraId. root@kitploit: usage: decryptcachedata.py -h pin,password ... CacheData bruteforcer. On a live windows host, to copy the folders with all subfolders and files: xcopy /H /E /G /C as SYSTEM...

EvilMist

EvilMist EvilMist is a collection of scripts and utilities designed to support cloud security configuration audit, cloud penetration testing & cloud red teaming. The toolkit helps identify misconfigurations, assess privilege-escalation paths, and simulate attack techniques. EvilMist aims to...

EntraGoat

EntraGoat - A Deliberately Vulnerable Entra ID Environment EntraGoat is a deliberately vulnerable Microsoft Entra ID infrastructure for security professionals. Deploy real-world identity misconfigurations and privilege escalation paths in your own tenant, then practice exploiting them in a safe,...

AzureAD-Attack-Defense

Microsoft Entra ID - دليل الهجوم والدفاع هذا الإصدار عبارة عن مجموعة من سيناريوهات الهجوم الشائعة المختلفة على Microsoft Entra وكيف يمكن التخفيف منها أو اكتشافها. جميع السيناريوهات والرؤى والتعليقات المضمنة تستند إلى تجارب المساهمين خلال عمليات محاكاة الهجوم أو التطبيق العملي أو السيناريوهات...