MSOLSpray

MSOLSpray A password spraying tool for Microsoft Online accounts Azure/O365. The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled. BE VERY CAREFUL NOT TO LOCKOUT...

smartbrute

Description The smart password spraying and bruteforcing tool for Active Directory Domain Services. ⚠️ This project works. But the filthy coding makes it more PoC than a stable tool. I may or may not rewrite this in the future, but at least you have everything here to work with bruteforce on any...

Oh365UserFinder

Oh365 User Finder v1.1.2 Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify...

SharpSpray

SharpSpray This project is a C port of my PowerSpray.ps1 script. SharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike. https://github.com/jnqpblc/Misc-PowerShell/blob/master/PowerSpray.ps1 By default it wi...

TeamFiltration

TeamFiltration TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 EntraID accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running! This tool has bee...

SharpHose

Overview SharpHose is a C password spraying tool designed to be fast, safe, and usable over Cobalt Strike's execute-assembly. It provides a flexible way to interact with Active Directory using domain-joined and non-joined contexts, while also being able to target specific domains and domain...

ActiveReign

ActiveReign ⚠️ Thank you for your support. This project is no longer publicly maintained. Background A while back I was challenged to write a discovery tool with Python3 that could automate the process of finding sensitive information on network file shares. After writing the entire tool with...

SharpSpray

SharpSpray SharpSpray is a Windows domain password spraying tool written in .NET C. Introduction SharpSpray is a C port of DomainPasswordSpray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services. Features Can operate from...

TREVORspray

TREVORspray 2.0 TREVORspray is a modular password sprayer with threading, SSH proxying, loot modules, and more! By @thetechr0mancer Installation: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray See the...

CrackQL

CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. Table of Contents How it works Attack Use Cases Defense Evasion...

spraycharles

Spraycharles hey, yo I'm feeling like spraycharles - Chiddy Bang Low and slow password spraying tool, designed to spray on an interval over a long period of time. Includes spraying plugins for Office365, OWA, EWS, Okta, ADFS, Cisco SSL VPN, Citrix Netscaler, Sonciwall, NTLM over HTTP, and SMB...

spraygen

Spraygen Password list generator for password spraying - prebaked with goodies Version 1.7 Generates permutations of Months, Seasons, Years, Sports Teams NFL, NBA, MLB, NHL, Sports Scores, "Password", and even Iterable Keyspaces of a specified size. All permutations are generated with common...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

cerbrutus

Cerbrutus Modular brute force tool written in Python, for very fast password spraying SSH, and FTP and in the near future other network services. COMING SOON: SMB, HTTPs POST, HTTPs GET, HTTP BASIC AUTH Thanks to @0dayctf, Rondons, Enigma, and 001 for testing and contributing Installation: cd /op...

chalumeau

Chalumeau Chalumeau is automated,extendable and customizable credential dumping tool based on powershell and python. Main Features Write your own Payloads In-Memory execution Extract Password List Dashboard reporting / Web Interface Parsing Mimikatz Dumping Tickets Screenshots Known Issues Parsin...

Invoke-CleverSpray

Invoke-CleverSpray Password Spraying Script detecting current and previous passwords of Active Directory User by @flelievre Options: -Password: Password to spray. -PasswordFile: Path to file containing a list of passwords to spray. -Username: samAccountName of the user to target. -UsernamesFile:...

o365spray

o365spray o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 O365. This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments. For educational, authorized and/or research purpose...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

RDWAtool

A python all-in-one tool to extract information, spray and bruteforce passwords on a Microsoft Remote Desktop Web Access RDWA application. This python tool allows to extract various information from a Microsoft Remote Desktop Web Access RDWA application, such as the FQDN of the remote server, the...

HunterScrape

This is a python script using the hunter.io API to pull data on a target domain, then generate a target email list. This is primarily for password spraying using a tool like Go365 or TREVORspray. Usage: HunterScrape-Dev.py -h -d DOMAIN -k KEY -l LIMIT -f -o OUTFILE options: -h, --help show this...