SSOh-No is designed to enumerate users, password spray and perform brute force attacks against any organisation that utilises Azure AD or O365.
Generally, this endpoint provides extremely verbose errors which can be leveraged to enumerate users and validate their passwords via brute force/spraying attacks, while also failing to log any failed authentication attempts.
This tool is a weaponised version of a PoC demonstrated in the arstechnica research article which discusses the techniques utilised to exploit the endpoint.
This endpoint is known to Microsoft however, in typical fashion it has been branded a feature, not a bug.
This endpoint does enforce “smart locking” which can be bypassed by rotating IP.
The SSO Autologon endpoint does not contain logging of any sort bar potentially updating the users “Last Logon” time.
The following have been tested and contain no logs:
$ ./SSOh-No -h
usage: SSOh-No [-h|–help] [-e|–email “”] [-p|–password “”]
[-U|–userlist “”] [-o|–outfile “”]
Enumerate and abuse a sub-par Azure SSO endpoint.
Arguments:
-h –help Print help information
-e –email Email address to query. Example: user@domain.com
-p –password Password to spray. Example: Password123!
-U –userlist Specify userlist to enumerate
-o –outfile Specify outfile. Example: validated.txt
This repository contains tools created by yogSahare0 while learning Python 3 for ethical hacking and penetration testing.…
"NetSecChallenger" provides a suite of automated tools designed for security professionals and network administrators to…
The essential tool for cybersecurity enthusiasts! This guide provides a detailed walkthrough on how to…
Meet "Poodone," the ultimate Python script designed for cybersecurity enthusiasts and professionals alike. Packed with…
The Linux version is no longer supported! The last Linux version is 6.0 that you…
Jin is a hacking command-line tools designed to make your scan port, gathering urls, check…