Note: This repository is no longer being developed
MSSpray is used to conduct password spray attacks against Azure AD as well as validate the implementation of MFA on Azure and Office 365 endpoints
------------------------------------------------------------
| ;---<<<<,______________________________________________ |
| _|_ / / ____/ ____/ __ / __ / __ / / / |
| / \ / / / /____ /____ / ___/ __/ / \ / |
| | | /__/__/__/______/______/__/ /__/\_\__/__/ /__/ |
| |___| |
------------------------------------------------------------
Perform a password spray against the selected endpoint with the supplied userfile (one email address per line) and password and the option to stop on success (stop):
python3 msspray.py spray <userfile> <password> <endpoint_selection> <stop/blank>
Check each endpoint for authentication with a valid username and password:
python3 msspray.py validate <username> <password>
| Number | Endpoint | Endpoint URL |
|---|---|---|
| [1] | aad_graph_api | https://graph.windows.net |
| [2] | ms_graph_api | https://graph.microsoft.com |
| [3] | azure_mgmt_api | https://management.azure.com |
| [4] | windows_net_mgmt_api | https://management.core.windows.net |
| [5] | cloudwebappproxy | https://proxy.cloudwebappproxy.net/registerapp |
| [6] | officeapps | https://officeapps.live.com |
| [7] | outlook | https://outlook.office365.com |
| [8] | webshellsuite | https://webshell.suite.office.com |
| [9] | sara | https://api.diagnostics.office.com |
| [10] | office_mgmt | https://manage.office.com |
| [11] | msmamservice | https://msmamservice.api.application |
| [12] | spacesapi | https://api.spaces.skype.com |
| [13] | datacatalog | https://datacatalog.azure.com |
| [14] | database | https://database.windows.net |
| [15] | AzureKeyVault | https://vault.azure.net |
| [16] | onenote | https://onenote.com |
| [17] | o365_yammer | https://api.yammer.com |
| [18] | skype4business | https://api.skypeforbusiness.com |
| [19] | o365_exchange | https://outlook-sdf.office.com |
spray against https://graph.windows.net, stopping on first successful login
python3 msspray.py spray users.txt Spring2020 1 stop
spray against https://management.core.windows.net
python3 msspray.py spray users.txt Spring2020 4
check all endpoints using valid account
python3 msspray.py validate bill.smith@sra.io ReallyBadPass
Blog Post: https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/
For any questions, feel free to reach out to me on Twitter @__TexasRanger