o365spray

Username enumeration and password spraying tool aimed at Microsoft O365.

1,002

119

1,002

View on GitHub

Top Related Projects

MSOLSpray

1,088

A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

SprayingToolkit

1,567

Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient

MicroBurst

2,376

A collection of scripts for assessing Microsoft Azure security

AADInternals

1,644

AADInternals PowerShell module for administering Azure AD and Office 365

TREVORspray

1,147

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

Quick Overview

The 0xZDH/o365spray repository is a Python-based tool designed for performing password spraying attacks against Microsoft Office 365 (O365) accounts. Password spraying is a technique used to test a large number of common passwords against multiple accounts to gain unauthorized access.

Pros

Automates the process of password spraying against O365 accounts, making it more efficient and scalable.
Supports various authentication methods, including basic authentication, modern authentication, and multi-factor authentication.
Provides detailed logging and reporting capabilities to help users analyze the results of the attack.

Cons

The tool is designed for offensive security purposes and can be used for malicious activities, which may be illegal in some jurisdictions.
Requires a good understanding of password spraying techniques and the O365 authentication process to use effectively.
May trigger security alerts or account lockouts, depending on the target organization's security measures.

Code Examples

The 0xZDH/o365spray repository is a command-line tool, and it does not provide a code library for integration into other projects. However, you can find the following code examples in the project's main script:

Performing a password spray attack:

def spray(self):
    """Perform the password spray attack."""
    for user in self.users:
        for password in self.passwords:
            try:
                self.auth_method.authenticate(user, password)
                self.logger.success(f"Valid credentials found: {user}:{password}")
                self.valid_creds.append((user, password))
            except AuthenticationError as e:
                self.logger.error(f"Invalid credentials: {user}:{password}")
            except Exception as e:
                self.logger.error(f"Error authenticating {user}: {e}")

Handling multi-factor authentication:

def handle_mfa(self, user, password):
    """Handle multi-factor authentication."""
    mfa_code = input(f"Enter MFA code for {user}: ")
    try:
        self.auth_method.authenticate(user, password, mfa_code)
        self.logger.success(f"Valid credentials found: {user}:{password}")
        self.valid_creds.append((user, password))
    except AuthenticationError as e:
        self.logger.error(f"Invalid credentials: {user}:{password}")
    except Exception as e:
        self.logger.error(f"Error authenticating {user}: {e}")

Logging and reporting:

def log_results(self):
    """Log the results of the password spray attack."""
    self.logger.info(f"Valid credentials found: {len(self.valid_creds)}")
    for user, password in self.valid_creds:
        self.logger.success(f"Valid credentials: {user}:{password}")

Getting Started

To get started with the 0xZDH/o365spray tool, follow these steps:

Clone the repository:

git clone https://github.com/0xZDH/o365spray.git

Install the required dependencies:

pip install -r requirements.txt

Customize the configuration file (config.py) with your target users, passwords, and other settings.
Run the tool:

python o365spray.py

The tool will start the password spraying attack and display the results in the console. You can also enable logging to a file by modifying the config.py file.

Competitor Comparisons

MSOLSpray

1,088

Pros of MSOLSpray

Simpler and more straightforward implementation
Focuses specifically on Microsoft Online (MSOL) authentication
Lightweight with minimal dependencies

Cons of MSOLSpray

Limited functionality compared to o365spray
Less actively maintained (last update in 2020)
Lacks support for additional Office 365 services

Code Comparison

MSOLSpray:

$UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
$Uri = "https://login.microsoftonline.com/common/oauth2/token"

o365spray:

self.base_url = "https://login.microsoftonline.com"
self.default_useragent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"

Both projects use similar user agents and target the Microsoft Online login URL. However, o365spray is implemented in Python, while MSOLSpray is written in PowerShell. o365spray offers a more comprehensive set of features and modules for testing various Office 365 services, whereas MSOLSpray focuses primarily on MSOL authentication.

SprayingToolkit

1,567

Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient

Pros of SprayingToolkit

Supports multiple services beyond Office 365, including OWA, Lync, and ADFS
Offers a modular architecture, allowing for easier extension to new services
Includes additional features like username enumeration and custom wordlist generation

Cons of SprayingToolkit

Less focused on Office 365 specific features compared to o365spray
May require more setup and configuration due to its broader scope
Last updated in 2021, potentially less current than o365spray

Code Comparison

o365spray:

def perform_spray(self, password):
    for username in self.userlist:
        result = self.auth_O365(username, password)
        if result:
            self.valid_accounts.append((username, password))

SprayingToolkit:

def spray(self, passwords):
    for password in passwords:
        for username in self.usernames:
            result = self.auth_method(username, password)
            if result:
                self.found.append((username, password))

Both tools use similar approaches for password spraying, iterating through usernames and passwords. However, SprayingToolkit's implementation is more generalized, allowing for different authentication methods, while o365spray is specifically tailored for Office 365 authentication.

MicroBurst

2,376

A collection of scripts for assessing Microsoft Azure security

Pros of MicroBurst

Broader scope of Office 365 and Azure AD assessment tools
Includes modules for Azure resource enumeration and exploitation
More comprehensive documentation and usage examples

Cons of MicroBurst

Less focused on password spraying and user enumeration
May require more setup and configuration for specific tasks
Not as actively maintained (last update over a year ago)

Code Comparison

MicroBurst (PowerShell):

$Users = Get-Content .\userlist.txt
$Passwords = Get-Content .\passlist.txt
foreach ($Password in $Passwords) {
    foreach ($User in $Users) {
        Test-MSOLCredentials -Username $User -Password $Password
    }
}

o365spray (Python):

from o365spray import core

sprayer = core.O365Spray(
    username_file="userlist.txt",
    password_file="passlist.txt",
    output_file="results.txt"
)
sprayer.password_spray()

Both repositories offer tools for Office 365 and Azure AD security assessment, but they differ in focus and implementation. MicroBurst provides a wider range of modules for Azure-related tasks, while o365spray specializes in password spraying and user enumeration. o365spray offers a more streamlined approach with its Python implementation, making it easier to integrate into existing workflows. However, MicroBurst's PowerShell scripts may be more familiar to Windows administrators and security professionals working primarily in Microsoft environments.

AADInternals

1,644

AADInternals PowerShell module for administering Azure AD and Office 365

Pros of AADInternals

More comprehensive set of tools for Azure AD and Office 365 management and security testing
Supports a wider range of Azure AD and Office 365 related tasks, including tenant creation and management
Actively maintained with regular updates and new features

Cons of AADInternals

Steeper learning curve due to its extensive feature set
Requires PowerShell, which may not be as familiar to some users as Python
More complex setup process compared to o365spray

Code Comparison

AADInternals (PowerShell):

Import-Module AADInternals
$cred = Get-Credential
Get-AADIntAccessTokenForAADGraph -Credentials $cred

o365spray (Python):

from o365spray import core
sprayer = core.O365Spray(username='user@example.com', password='password')
sprayer.password_spray()

Both tools offer functionality for interacting with Office 365 and Azure AD, but AADInternals provides a more extensive set of features for advanced Azure AD management and security testing. o365spray focuses specifically on password spraying and user enumeration, making it more straightforward for these specific tasks. The choice between the two depends on the user's needs, preferred programming language, and the complexity of the tasks they need to perform.

TREVORspray

1,147

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!

Pros of TREVORspray

More advanced features like multi-threading and proxy support
Better handling of rate limiting and lockout avoidance
Includes additional modules for enumeration and reporting

Cons of TREVORspray

More complex setup and configuration required
Potentially slower execution due to additional features
May require more system resources

Code Comparison

o365spray:

def perform_spray(self, userlist, password):
    for user in userlist:
        result = self.auth_O365(user, password)
        self.process_result(user, password, result)

TREVORspray:

async def perform_spray(self, userlist, password):
    tasks = [self.auth_O365(user, password) for user in userlist]
    results = await asyncio.gather(*tasks)
    for user, result in zip(userlist, results):
        self.process_result(user, password, result)

The code comparison shows that TREVORspray uses asynchronous programming for potentially faster execution, while o365spray uses a simpler synchronous approach. TREVORspray's implementation allows for concurrent authentication attempts, which can be more efficient for large-scale spraying operations.

Both tools serve similar purposes but cater to different user needs. o365spray is simpler and more straightforward, while TREVORspray offers advanced features for more complex scenarios.

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

o365spray

o365spray is a username enumeration and password spraying tool aimed at Microsoft Office 365 (O365). This tool reimplements a collection of enumeration and spray techniques researched and identified by those mentioned in Acknowledgments.

For educational, authorized and/or research purposes only.

WARNING: The Autologon, oAuth2, and RST user enumeration modules work by submitting a single authentication attempt per user. If the modules are run in conjunction with password spraying in a single execution, o365spray will automatically reset the lockout timer prior to performing the password spray -- if enumeration is run alone, the user should be aware of how many and when each authentication attempt was made and manually reset the lockout timer before performing any password spraying.

Usage
Modules
FireProx URLs
- Enumeration
- Spraying
User Agent Randomization
Acknowledgments
Bugs
Previous Versions

Usage

Validate a domain is using O365:
o365spray --validate --domain test.com

Perform username enumeration against a given domain:
o365spray --enum -U usernames.txt --domain test.com

Perform password spraying against a given domain:
o365spray --spray -U usernames.txt -P passwords.txt --count 2 --lockout 5 --domain test.com

usage: o365spray [flags]

o365spray | Microsoft O365 User Enumerator and Password Sprayer -- v3.0.4

options:
  -h, --help            show this help message and exit

Target:
  -d DOMAIN, --domain DOMAIN
                        Target domain for validation, user enumeration, and/or
                        password spraying.

Actions:
  --validate            Run domain validation only.

  --enum                Run username enumeration.

  --spray               Run password spraying.

Credentials:
  -u USERNAME, --username USERNAME
                        Username(s) delimited using commas.

  -p PASSWORD, --password PASSWORD
                        Password(s) delimited using commas.

  -U USERFILE, --userfile USERFILE
                        File containing list of usernames.

  -P PASSFILE, --passfile PASSFILE
                        File containing list of passwords.

  --paired PAIRED       File containing list of credentials in username:password
                        format.

Password Spraying Configuration:
  -c COUNT, --count COUNT
                        Number of password attempts to run per user before resetting
                        the lockout account timer.
                        Default: 1

  -l LOCKOUT, --lockout LOCKOUT
                        Lockout policy's reset time (in minutes).
                        Default: 15 minutes

Module Configuration:
  --validate-module VALIDATE_MODULE
                        Specify which valiadtion module to run.
                        Default: getuserrealm

  --enum-module ENUM_MODULE
                        Specify which enumeration module to run.
                        Default: office

  --spray-module SPRAY_MODULE
                        Specify which password spraying module to run.
                        Default: oauth2

  --adfs-url ADFS_URL   AuthURL of the target domain's ADFS login page for password
                        spraying.

Scan Configuration:
  --sleep [-1, 0-120]   Throttle HTTP requests every `N` seconds. This can be randomized
                        by passing the value `-1` (between 1 sec and 2 mins).
                        Default: 0

  --jitter [0-100]      Jitter extends --sleep period by percentage given (0-100).
                        Default: 0

  --rate RATE           Number of concurrent connections (attempts) during
                        enumeration and spraying.
                        Default: 10

  --poolsize POOLSIZE   Maximum size of the ThreadPoolExecutor.
                        Default: 10000

  --safe SAFE           Terminate password spraying run if `N` locked accounts
                        are observed.
                        Default: 10

HTTP Configuration:
  --useragents USERAGENTS
                        File containing list of user agents for randomization.

  --timeout TIMEOUT     HTTP request timeout in seconds. Default: 25

  --proxy PROXY         HTTP/S proxy to pass traffic through
                        (e.g. http://127.0.0.1:8080).

  --proxy-url PROXY_URL
                        FireProx API URL.

Output Configuration:
  --output OUTPUT       Output directory for results and test case files.
                        Default: current directory

Debug:
  -v, --version         Print the tool version.

  --debug               Enable debug output.

Modules

Validation

getuserrealm (default)

Enumeration

autologon
oauth2 (default)
office
onedrive
rst

The onedrive module relies on the target user(s) having previously logged into OneDrive. If a valid user has not yet used OneDrive, their account will show as 'invalid'.

Spraying

activesync
adfs
autodiscover
autologon
oauth2 (default)
reporting
rst

The oAuth2 module can be used for federated spraying, but it should be noted that this will ONLY work when the target tenant has enabled password synchronization - otherwise authentication will always fail. The default mechanic is to default to the 'adfs' module when federation is identified.

FireProx Base URLs

Microsoft has made it more difficult to perform password spraying, so using tools like FireProx help to bypass rate-limiting based on IP addresses.

To use FireProx with o365spray, create a proxy URL for the given o365spray module based on the base URL tables below. The proxy URL can then be passed in via --proxy-url.

NOTE: Make sure to use the correct --enum-module or --spray-module flag with the base URL used to create the FireProx URL.

Enumeration

The 'tenant' value in the OneDrive URL is the domain name value that is provided via the --domain flag.

Module	Base URL
autodiscover	`https://outlook.office365.com/`
autologon	`https://autologon.microsoftazuread-sso.com/`
oauth2	`https://login.microsoftonline.com/`
office	`https://login.microsoftonline.com/`
rst	`https://login.microsoftonline.com/`
onedrive	`https://<tenant>-my.sharepoint.com/`

Spraying

Module	Base URL
activesync	`https://outlook.office365.com/`
adfs	Currently not implemented
autodiscover	`https://autodiscover-s.outlook.com/`
autologon	`https://autologon.microsoftazuread-sso.com/`
oauth2	`https://login.microsoftonline.com/`
reporting	`https://reports.office365.com/`
rst	`https://login.microsoftonline.com/`

User Agent Randomization

User-Agent randomization is now supported and can be accomplished by providing a User-Agent file to the --useragents flag. o365spray includes an example file with 4,800+ agents via resc/user-agents.txt.

The agents in the example data set were collected from the following:

Omnispray

The o365spray framework has been ported to a new tool: Omnispray. This tool is meant to modularize the original enumeration and spraying framework to allow for generic targeting, not just O365. Omnispray includes template modules for enumeration and spraying that can be modified and leveraged for any target.

Acknowledgments

Author	Tool/Research	Link
gremwell	o365enum: User enumeration via office.com without authentication	o365enum
grimhacker	office365userenum: ActiveSync user enumeration research and discovery.	office365userenum / blog post
Raikia	UhOh365: User enumeration via Autodiscover without authentication.	UhOh365
dafthack	MSOLSpray: Password spraying via MSOL	MSOLSpray
byt3bl33d3r	MSOLSpray: Python reimplementation	Gist
nyxgeek	onedrive_user_enum: OneDrive user enumeration	onedrive_user_enum / blog post
Mr-Un1k0d3r	adfs-spray: ADFS password spraying	adfs-spray
Nestori Syynimaa	AADInternals: oAuth2 and autologon modules	AADInternals
Daniel Chronlund / xFreed0m	Invoke-AzureAdPasswordSprayAttack / ADFSpray: Office 365 reporting API password spraying	Invoke-AzureAdPasswordSprayAttack / ADFSpray
Optiv (Several Authors)	Go365: RST user enumeration and password spraying module	Go365
byt3bl33d3r	SprayingToolkit: Code references	SprayingToolkit
sensepost	ruler: Code references	Ruler

Bugs

If any bugs/errors are encountered, please open an Issue with the details (or a Pull Request with the proposed fix). See the section below for more information about using previous versions.

Using Previous Versions

If issues are encountered, try checking out previous versions prior to code rewrites:

# v1.3.7
git checkout e235abdcebad61dbd2cde80974aca21ddb188704

# v2.0.4
git checkout a585432f269a8f527d61f064822bb08880c887ef

Top Related Projects

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

Top Related Projects

Quick Overview

Pros

Cons

Code Examples

Getting Started

Competitor Comparisons

Pros of MSOLSpray

Cons of MSOLSpray

Code Comparison

Pros of SprayingToolkit

Cons of SprayingToolkit

Code Comparison

Pros of MicroBurst

Cons of MicroBurst

Code Comparison

Pros of AADInternals

Cons of AADInternals

Code Comparison

Pros of TREVORspray

Cons of TREVORspray

Code Comparison

Convert designs to code with AI

README

o365spray

Table of Contents

Usage

Modules

Validation

Enumeration

Spraying

FireProx Base URLs

Enumeration

Spraying

User Agent Randomization

Omnispray

Acknowledgments

Bugs

Using Previous Versions

Top Related Projects

Convert designs to code with AI