Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify false positives based on response, and either automatically create a waiting period to allow the throttling value to reset, or warn the user to increase timeouts between attempts. Oh365UserFinder can also easily identify if a domain exists in o365 using the -d or --domain flag. This saves the trouble of copying the url from notes and entering it into the URL bar with the target domain.
Usage Installing Oh365UserFinder git clone https://github.com/dievus/Oh365UserFinder.git Change directories to Oh365UserFinder and run: pip3 install -r requirements.txt This will run the install script to add necessary dependencies to your system. python3 Oh365UserFinder.py -h This will output the help menu, which contains the following flags: -h, --help - Lists the help options -e, --email - Required for running Oh365UserFinder against a single email (https://www.kitploit.com/search/label/Email) account -r, --read - Reads from a text file containing emails (https://www.kitploit.com/search/label/Emails) (ex. -r emails.txt) -w, --write - Writes valid emails to a text document (ex. -w validemails.txt) -c, --csv - Writes valid emails to a CSV file (ex. -c validemails.csv) -t, --timeout - Sets a pause between attempts in seconds (ex. -t 60) -d, --domain - Checks if the listed domain is valid or not (ex. -d mayorsec.com) --verbose - Outputs test verbosely Examples of full commands include: python3 o365UserFinder.py -e example@test.com python3 Oh365UserFinder.py -r emails.txt -w validemails.txt python3 Oh365UserFinder.py -r emails.txt -w validemails.txt -t 30 -v Notes Make note that Microsoft (https://www.kitploit.com/search/label/Microsoft) does have some defense in place that can, from time to time, provide false positives in feedback. If you suspect that this is occurring take a pause in testing, and return and increase the duration between attempts using the -t flag.

___________________________
@hacking_Attack
@Hacking_Video

Acknowledgements This started as a port over from Python2 (https://www.kitploit.com/search/label/Python2) to Python3 of a tool named o365Creeper developed by Korey Mckinley, and it quickly spiraled into what it is now.

Download Oh365UserFinder (https://github.com/dievus/Oh365UserFinder)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Oh365UserFinder - Python3 O365 User Enumeration Tool

___________________________
@hacking_Attack
@Hacking_Video

FILE UPLOAD RESTRICTION BYPASS

We all might have faced a file upload functionality while testing a site, Maybe during ctf’s, or real world pentest, or bug bounties.Continue reading on Medium »
Read more...

($$$) Broken Authentication and IDOR at [REDACTED]

Hello infosec community hope you guys are good, I want to share my finding in bug bounty about Broken Authentication and Insecure Direct…Continue reading on Medium »
Read more...

Oh365UserFinder - Python3 O365 User Enumeration Tool

Oh365UserFinder is used for identifying valid o365 accounts and domains without the risk of account lockouts. The tool parses responses to identify the "IfExistsResult" flag is null or not, and responds appropriately if the user is valid. The tool will attempt to identify false positives based on response, and either automatically create a waiting period to allow the throttling value to reset, or warn the user to increase timeouts between attempts. Oh365UserFinder can also easily identify if a domain exists in o365 using the -d or --domain flag. This saves the trouble of copying the url from notes and entering it into the URL bar with the target domain. Usage Installing Oh365UserFinder git clone https://github.com/dievus/Oh365UserFinder.git Change directories to Oh365UserFinder and run: pip3 install -r requirements.txt This will run the install script to add necessary dependencies to your system. python3 Oh365UserFinder.py -h This will output the help menu, which contains the following flags: -h, --help - Lists the help options -e, --email - Required for running Oh365UserFinder against a single email account -r, --read - Reads from a text file containing emails (ex. -r emails.txt) -w, --write - Writes valid emails to a text document (ex. -w validemails.txt) -c, --csv - Writes valid emails to a CSV file (ex. -c validemails.csv) -t, --timeout - Sets a pause between attempts in seconds (ex. -t 60) -d, --domain - Checks if the listed domain is valid or not (ex. -d mayorsec.com) --verbose - Outputs test verbosely Examples of full commands include: python3 o365UserFinder.py -e example@test.com python3 Oh365UserFinder.py -r emails.txt -w validemails.txt python3 Oh365UserFinder.py -r emails.txt -w validemails.txt -t 30 -v Notes Make note that Microsoft does have some defense in place that can, from time to time, provide false positives in feedback. If you suspect that this is occurring take a pause in testing, and return and increase the duration between attempts using the -t flag. Acknowledgements This started as a port over from Python2 to Python3 of a tool named o365Creeper developed by Korey Mckinley, and it quickly spiraled into what it is now. Download Oh365UserFinder
Read more...

___________________________
@hacking_Attack
@Hacking_Video

($$$) Broken Authentication and IDOR at [REDACTED]
https://wahaz.medium.com/broken-authentication-and-idor-at-redacted-646de8d508e6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello infosec community hope you guys are good, I want to share my finding in bug bounty about Broken Authentication and Insecure Direct…Continue reading on Medium » (https://wahaz.medium.com/broken-authentication-and-idor-at-redacted-646de8d508e6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Crowdsourced Efforts Get Leveraged in Ukraine Conflict

The battle is not just being waged in the physical world — it's also happening online. And average people are taking part, not just governments.

Dark Reading: Attacks/Breaches
Will the Biggest Clouds Win? Lessons From Google's Mandiant Buy

Google eventually won out in the competition for Mandiant, but Microsoft's interest underscores the trend in consolidation of security services into large cloud providers, experts say.

Dark Reading: Attacks/Breaches
Ransomware Attack Led Bridgestone to Halt US Tire Production for a Week

Japanese manufacturer confirmed a Feb. 27 attack on its US subsidiary that led to a temporary production shutdown.

___________________________
@hacking_Attack
@Hacking_Video

TryHackMe: Chocolate Factory Write-up

Let’s boot the machine and start hacking!!!.
Read more...

Pen Test Diaries: Last One In
https://mike-sheward.medium.com/pen-test-diaries-last-one-in-ae205cfb6a3b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This story is part of the Pen Test Diaries series, you can read more about the series here.Continue reading on Medium » (https://mike-sheward.medium.com/pen-test-diaries-last-one-in-ae205cfb6a3b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video