AzureHound

AzureHound The BloodHound data collector for Microsoft Azure Get AzureHound Release Binaries Download the appropriate binary for your platform from one of our Releases. Rolling Release The rolling release contains pre-built binaries that are automatically kept up-to-date with the main branch and...

CredSpy

CredSpy Enumerate Microsoft Entra ID authentication methods for email addresses using the public GetCredentialType API. This is the same endpoint the Microsoft login page uses when you enter a username. In contrast to most tools using the GetCredentialType method, CredSpy also shows the...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

Azure-Sentinel

Microsoft Sentinel and Microsoft 365 Defender Welcome to the unified Microsoft Sentinel and Microsoft 365 Defender repository! This repository contains out of the box detections, exploration queries, hunting queries, workbooks, playbooks and much more to help you get ramped up with Microsoft...

CVE-2017-0108

The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to execute arbitrary code v...

cve-2020-17057

cve-2020-17057 cve-2020-17057 poc Microsoft released a patch on 2020-11-10...

p-invoke.net

p-invoke.net This repository contains most of the P/Invoke definitions from the most-of-the-time offline pinvoke.net, adding the link to the Microsoft documentation for each one. The Gitbook is available at https://ricardojoserf.gitbook.io/pinvoke. Notes I did this to check some definitions in a...

CVE-2022-30190

CVE-2022-30190 Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability MSRC / By msrc / May 30, 2022 On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool MSDT in Windows vulnerability. A remote code execution vulnerability...

TokenTacticsV2

root@kitploit: / / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku...

KSLDBYOVDARK

KSLDBYOVD Reference: KslKatz and KslDump. KslD.sys, a.k.a. MpKslDrv.sys, used to be one of the anti-rootkit tool drivers of Microsoft Antimaware which includes Microsoft Defender Antivirus, Windows Defender Antivirus in the old Windows versions, Microsoft Security Essentials, System Center Endpoi...

Check-vuln-CVE-2019-0708

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0. Metasploit module PR: https://github.com/rapid7/metasploit-framework/pull/11869 In this repo A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote...

EasyTokens

EasyTokens A device-code phishing server for adversary emulation. Captures Microsoft 365 OAuth tokens via the Device Authorization Grant flow. Inspired by GraphSpy. Warning — Authorized Use Only. This tool is intended for penetration testers and red teamers operating under explicit written...

DefenderCheck

DefenderCheck Quick tool to help make evasion work a little bit easier. Warning: As of the 1.337.157.0 Defender signature update, DefenderCheck is classified as VirTool:MSIL/BytzChk.C!MTB. As a workaround while I work to get around this, please disable Real-time Protection in Defender before...

ProcDump-for-Linux

ProcDump ProcDump is a Linux and Mac reimagining of the classic ProcDump tool from the Sysinternals suite of tools for Windows. ProcDump provides a convenient way for Linux and Mac developers to create core dumps of their application based on performance triggers. ProcDump for Linux and Mac is pa...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

CVE-2020-0688

Identify Exchange Servers vulnerable to CVE-2020-0688 CVE-2020-0688 is a critical vulnerability in Microsoft Exchange due to use of static keys. Although exploitation requires valid credentials at an email user level and the risk of mass-exploitation is low, this vulnerability might be very usefu...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

RTF_11882_0802

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Research: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis:...

CVE-2019-0708-Check-Device-Patch-Status

CVE-2019-0708-Vulnerability-Scanner Powershell script to run and determine if a specific device has been patched for CVE-2019-0708. This checks to see if the termdd.sys file has been updated appropriate and is at a version level at or greater than the versions released in the 5/14/19 patches. All...

AzureRedOps

AzureRedOps A Swiss Army tool for Azure / Entra ID red teaming. Author: Mr.Un1k0d3r TrueCyber Inc Version: 0.1 Language: Python 3.12+ Overview AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team...