reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

reportly

Reportly 是一款 EntraID 用户活动报告工具。 关于本工具 本工具旨在帮助蓝队在云安全事件调查中快速获取信息。 运行时，研究者输入可疑用户和时间范围，即可生成一份详细报告，内容包括： 1. 用户信息 2. 用户执行的操作 3. 针对用户执行的操作 4. 用户登录及失败日志 使用方法 运行工具时，会显示身份验证链接和设备代码，请访问链接并输入代码完成验证。 输入可疑用户的用户主体名称（User Principal Name）。 按以下格式输入开始和结束时间：2022-11-16 建议时间跨度不超过一周。 报告生成完毕后，工具会输出“Your report is...

TokenMan

Suite de tokens de acceso y actualización. Token Man es una herramienta para apoyar actividades de post-explotación mediante tokens de acceso y/o actualización de AAD. Tabla de contenidos Uso Comandos Fetch Search Swap Mapa de IDs de cliente de la aplicación FOCI AZ OAuth Uso usage: tokenman.py -...

GraphStrike

GraphStrike Publicación del lanzamiento: GraphStrike: Usando Microsoft Graph API para hacer que el tráfico Beacon desaparezca Blog del desarrollador: GraphStrike: Anatomía del desarrollo de herramientas ofensivas Introducción GraphStrike es un conjunto de herramientas que permite que el Beacon...

azureOutlookC2

Azure Outlook C2 基于Azure Outlook的命令与控制工具，利用Microsoft Graph API进行C2通信和数据外泄。 通过Outlook邮箱远程控制被入侵的Windows设备。 创建者：Bobby Cooke @0xBoku & Paul Ungur @C5pider CTI威胁更新（2022年2月13日） Elastic安全实验室发现活跃入侵活动正在野外使用SIESTAGRAPH。SIESTAGRAPH利用Microsoft Graph API通过Outlook和OneDrive进行命令与控制。请查看下方关于Azure Outlook...

NeuVector - Information Disclosure

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges. id: CVE-2026-25703 info: name:...

M365Pwned

M365Pwned Herramientas de Red Team para la explotación de Microsoft 365 mediante la API de Microsoft Graph. Dos herramientas GUI de WinForms para enumerar, buscar y extraer datos de entornos M365 utilizando tokens OAuth a nivel de aplicación — sin interacción del usuario. Herramienta| Objetivo| Q...

ConditionalAccessDocumentation

Documentación de Acceso Condicional con PowerShell Este script de PowerShell documenta sus políticas de Acceso Condicional de Microsoft Entra. El script exporta todos los datos como un archivo csv que puede formatearse como libro de Excel. Para garantizar que todas las políticas puedan recuperars...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

msteams

msteams Un perfil C2 de Mythic que utiliza la API de Microsoft Graph para comunicarse a través de un canal de Microsoft Teams. Cómo funciona Agent Microsoft Teams Channel C2 Server Mythic 1. El agente se autentica en Microsoft Entra ID mediante credenciales de cliente OAuth2 2. Publica su mensaje...

CVE-2023-49103

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Exigimos el regreso seguro de todos los ciudadanos que han sido tomados como rehenes por el grupo terrorista Hamás. No descansaremos hasta que todos los rehenes sean liberados y regresen a casa sanos y salvos. Puedes ayudar a traerlos de vuelta a...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — Meta-Phishing Facebook Graph API — Reutilización de Tokens OAuth y Secuestro de Sesión Campo| Valor ---|--- Severidad| 9.6 Crítica Vector| Red Versiones Afectadas| Graph API v18.0 – v20.0 Descubierto Por| 𝕍𝕠𝕤𝕤🥷 Descripción Una vulnerabilidad crítica en la Graph API de Facebook...

CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress (versions up to and including 2.20.0 ) is vulnerable to Sensitive Information Exposure . The root cause is a missing capability check in the editor_assets function, which exposes the uag_insta_linked_accounts option via the uagb_blocks_in...

EUVD-2026-85856

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302: Exposure of Sensitive Information to an Unauthorized Actor

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

PT-2026-97784

Name of the Vulnerable Software and Affected Versions Spectra Legacy – Gutenberg Blocks versions prior to 2.20.1 Description Sensitive information exposure occurs via the editor assets function, which exposes the uag insta linked accounts option through the uagb blocks info object without...

CVE-2026-18056

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...