o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

TeamFiltration

TeamFiltration TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 EntraID accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running! This tool has bee...

Wynis

Wynis Just a powershell scripts for auditing security with BEST Practices Windows env You just need to run the script, it will create a directory named : AUDITCONF%MACHINENAME%DATE% Actualy, the script are : -WynisWIN2016DC-CISv1.0 : Auditing DC 2016 with CIS -Wynis-AD : Auditing Domain Security...

AzureHunter

A Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes. Getting Started 1. Check that you have the right O365 Permissions...

GoMapEnum

This project was originally written to learn Golang and explore the different ways I've encountered when pentesting to enumerate or brute force users and write them together. If you have any errors, feel free to create an issue and I'll do my best to fix them or improve the tools. GoMapEnum Nothi...

Oh365UserFinder

Oh365 User Finder v1.1.2 Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify...

O365-Doppelganger

O365-Doppelganger O365-Doppelganger is NOT a replacement for hardcore phishing activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger. O365-Doppelganger is a quick handy script to harvest credentials of a user during Red Teams. This...

vortex

🚩 This is the public repository of vortex, for latest version and updates please consider supporting us through https://porchetta.industries/ Vortex VPN Overall Reconnaissance, Testing, Enumeration and Exploitation Toolkit 🚩 Sponsors If you want to sponsors this project and have the latest update...

CRT

CrowdStrike Reporting Tool for Azure CRT This tool queries the following configurations in the Azure AD/O365 tenant which can shed light on hard-to-find permissions and configuration settings in order to assist organizations in securing these environments. Exchange Online O365: Federation...

o365-attack-toolkit

o365-attack-toolkit 是什么 o365-attack-toolkit 允许操作者执行 OAuth 钓鱼攻击。 我们决定从静态定义的旧模式转向与账户进行完全“实时”交互。 一些变化 交互式邮件搜索 - 允许你像拥有完全访问权限一样搜索用户邮件。 发送邮件 - 允许你从用户邮箱发送包含附件的 HTML/TEXT 邮件。 交互式文件搜索和下载 - 允许你使用特定关键词搜索文件并离线下载。 文件替换 - 作为宏后门功能的替代方案实现。 架构 该工具包由几个组件组成 钓鱼端点 钓鱼端点负责提供执行 OAuth 令牌钓鱼的 HTML 文件。 后端服务...

CVE-2026-54733

The Moodle integration for Microsoft 365/Entra ID (local_o365) is vulnerable prior to 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users based on the upn claim without verifying the JWT signature, enabling an unauthenticated attacker...

CVE-2026-54733 moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

EUVD-2017-16264

Malware in sbrugna...

CVE-2021-44652

Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component...

CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

GHSA-9WGG-M99Q-HHFC Expired tokens can be renewed without validating the account password

Impact In versions of the proxy from 2022-09-05 onwards since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f, expired OAuth 2.0 client credentials grant CCG flow authorisation tokens could be renewed automatically without checking their validity against the original account configuration i.e., the...

TeamFiltration - Cross-Platform Framework For Enumerating, Spraying, Exfiltrating, And Backdooring O365 AAD Accounts

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running! This tool has been used internally...

SSOh-No - User Enumeration And Password Spraying Tool For Testing Azure AD

This tool is designed to enumerate users, password spray and perform brute force attacks against any organisation that utilises Azure AD or O365. Generally, this endpoint provides extremely verbose errors which can be leveraged to enumerate users and validate their passwords via brute...