Go365

Go365 v2.0 修复了AWS网关问题（感谢h0useh3ad！） 当代理服务器连接失败时不再崩溃 新增了图形端点 在使用Go365之前，请通读本README！ Go365是一款用于对使用Office365（现/即将更名为Microsoft365）的组织执行用户枚举和密码猜测攻击的工具。Go365使用了一个位于login.microsoftonline.com上的独特SOAP API端点，大多数其他工具不使用该端点。当使用电子邮件地址和密码进行查询时，该端点会返回一个Azure AD身份验证和授权码。Go365会处理该代码，并将结果显示在屏幕上或输出到文件中。...

UhOh365

UhOh365 一个可以检查电子邮件地址在Office365中是否有效的脚本。此脚本不进行任何登录尝试，未受速率限制，对于社会工程学评估中查找哪些电子邮件存在、哪些不存在非常有用。 微软并不认为“电子邮件枚举”是一个漏洞，因此这利用了“特性”。还有其他几个公开的Office365电子邮件验证脚本，但据我所见，它们每个用户帐户至少需要1次登录尝试。这是可检测的 ，并且可能被视为轻量级暴力破解尝试（对多个帐户使用一个“常见”密码）。 此脚本允许零登录尝试 的电子邮件验证，仅使用微软内置的Autodiscover...

spraycharles

Spraycharles hey, yo, me siento como spraycharles - Chiddy Bang Herramienta de pulverización de contraseñas lenta y constante, diseñada para rociar en un intervalo durante un largo período de tiempo. Incluye plugins de pulverización para Office365, OWA, EWS, Okta, ADFS, Cisco SSL VPN, Citrix...

oauthseeker

OAuthSeeker OAuthSeeker es una herramienta de equipo rojo para realizar ataques de phishing utilizando aplicaciones OAuth maliciosas para comprometer identidades de usuarios en Microsoft Azure y Office365. 🚀 Características principales OAuthSeeker proporciona las siguientes características...

decode-spam-headers

decode-spam-headers.py Ya sea que estés tratando de entender por qué un correo electrónico específico terminó en SPAM/Correo no deseado para tus tareas administrativas diarias o para tus propósitos de simulación de phishing Red-Team, ¡este script está ahí para ayudarte! La idea surgió al realizar...

EUVD-2017-3883

Malware in sbrugna...

CVE-2024-36464 Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported

When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords...

"BingBang" flaw enabled altering of Bing search results, account takeover

Researchers from Wiz have discovered a way to allow for search engine manipulation and account takeover. The research in question focuses on several Microsoft applications, with everything stemming from a new type of attack aimed at Azure Active Directory. Azure Active Directory is a single sign-...

SecureMail: Modern Authentication doesn't work - "Incorrect user name or password"

You get the error"Incorrect user name or password" when trying to login your Office365 mailbox using Securemail When Securemail Network Access is set to Unrestricted the user is able to authenticate and synchronize emails properly...

What’s New in InsightIDR: Q4 2022 in Review

As we continue to empower security teams with the freedom to focus on what matters most, Q4 focused on investments and releases that contributed to that vision. With InsightIDR, Rapid7’s cloud-native SIEM and XDR solution, teams have the scale, comprehensive contextual coverage, and expertly vett...

Voicemail Scam Steals Microsoft Credentials

Attackers are using an oft-used and still effective lure to steal credentials to key Microsoft apps by sending emails notifying potential victims that they have a voicemail message, researchers have found. A team from Zscaler ThreatLabZ has been monitoring a campaign since May that targets key...

CVE-2021-43458

An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the 1 hsflowd, 2 VembuBDR360Agent, or 3 VembuOffice365Agent service paths...

“FudCo” Spam Empire Tied to Pakistani Software Firm

In May 2015, KrebsOnSecurity briefly profiled "The Manipulaters," the name chosen by a prolific cybercrime group based in Pakistan that was very publicly selling spam tools and a range of services for crafting, hosting and deploying malicious email. Six years later, a review of the social media...

How to Configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider

This article describes how to configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider and this article also provides detailed steps to configure Windows Azure to use NetScaler as a Security Token Service STS/ Identity Provider IDP...

OneDrive Sync Provider Enumeration Module

This module will identify the Office 365 OneDrive endpoints for both business and personal accounts across all users providing access is permitted. It is useful for identifying document libraries that may otherwise not be obvious which could contain sensitive or useful information. Module Options...

UhOh365 - A Script That Can See If An Email Address Is Valid In Office365 (User/Email Enumeration)

A script that can see if an email address is valid in Office365. This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't. Microsoft does not consider "email enumeration" a vulnerability, so th...

Go365 - An Office365 User Attack Tool

Go365 is a tool designed to perform user enumeration and password guessing attacks on organizations that use Office365 now/soon Microsoft365. Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the...

Digitally Signed Bandook Trojan Reemerges in Global Spy Campaign

A wave of targeted cyberattack campaigns bent on espionage is cresting around the globe, using a strain of a 13-year old backdoor trojan named Bandook. According to Check Point Research, Bandook was last spotted being used in 2015 and 2017/2018, in the “Operation Manul” and “Dark Caracal”...

STRONTIUM: Detecting new patterns in credential harvesting

Microsoft has tied STRONTIUM to a newly uncovered pattern of Office365 credential harvesting activity aimed at US and UK organizations directly involved in political elections. Analysts from Microsoft Threat Intelligence Center MSTIC and Microsoft Identity Security have been tracking this new...

Fake Zoom meeting invitation phishing scam harvests Microsoft credentials

By Sudais Asif Initially targeting Zoom users; the phishing scam aims for Outlook and Office365 credentials. This is a post from HackRead.com Read the original post: Fake Zoom meeting invitation phishing scam harvests Microsoft credentials...