Entraspray is a rewrite of MSOLSpray in python. The main purpose of this tool remains the same: to perform password spraying against Microsoft Azure accounts while also providing detailed information about account status and errors; such as if MFA is enabled, if a tenant or user doesn’t exist, if the account is locked or disabled and more.
The tool supports using FireProx to rotate source IP addresses on authentication requests, avoiding being blocked by Microsoft Entra Smart Lockout.
python3 -m venv venv
source venv/bin/activate
python3 -m pip install -r requirements.txt
provide a userlist file with the target email addresses one per line for example ‘user@example.com‘. Use caution to avoid locking out accounts, as this tool can trigger Microsoft Entra Smart Lockout if used incorrectly.
python3 entraspray.py --userlist userlist.txt --password Password123
--userlist : Path to a file containing usernames one-per-line in the format 'user@example.com'.
--password : Password to be used for the password spraying.
--url : URL to spray against. Useful if using FireProx to randomize the IP address you are authenticating from.
--delay : Number of seconds to delay between requests.
--verbose : Show invalid password attempts.
--force : Force the spray to continue even if multiple account lockouts are detected.
--debug : Show web request and response.
--proxy : Specify a proxy host to send all traffic through.
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…
The touch command is one of the quickest ways to create new empty files or update timestamps…
Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…
Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…
Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…