KitPloit - PenTest Tools!
SSOh-No - User Enumeration And Password Spraying Tool For Testing Azure AD

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPAGUnwLISOeAKG_H8ovlfsgHxS43aSvzxSyqxHElUFm8mgR25ygy2-NDVWZlCSPgddzOWfQFasHcnnwXRCZEKN7MoltMW_uj-OBN2EyRHX16jbZVG5ZTUEcHaUhVhh2LUbYEoB4UL2sVGARawYgvHoQJJ1FW3UGcRF_-LZ9EuUnlmqLLD2iQKa1LN/w640-h502/SSOh-No.png
This tool is designed to enumerate users, password spray and perform brute force attacks against any organisation that utilises Azure AD or O365.

Generally, this endpoint provides extremely verbose errors which can be leveraged to enumerate users and validate their passwords via brute force/spraying attacks, while also failing to log any failed authentication attempts.

This tool is a weaponised version of a PoC demonstrated in the arstechnica research article which discusses the techniques utilised to exploit the endpoint.

This endpoint is known to Microsoft however, in typical fashion it has been branded a feature, not a bug.

This endpoint does enforce "smart locking" which can be bypassed by rotating IP.
Why Is This Unique?

The SSO Autologon endpoint does not contain logging of any sort bar potentially updating the users "Last Logon" time.

The following have been tested and contain no logs:

* AzureAD
* Sentinel
* Defender for Identity (Formerly Advanced Thread Protection)
* Defender for Cloud Apps

Usage
$ ./SSOh-No -h usage: SSOh-No [-h|--help] [-e|--email "
Upcoming Features

* Proxy Implementation to bypass smart lock
* Password brute force from password lists (single user- No plans for password list brute force against a userlist)
Download SSOh-No

___________________________
@hacking_Attack
@Hacking_Video

Xml External Entity Web Application Vulnerability : Mechanisms Part

XML external entity attacks (XXEs) are fascinating vulnerabilities that target the XML parsers of an application. XXEs can be very…Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Google Will Use Mobile Devices to Thwart Phishing Attacks

In an effort to combat phishing, Google will allow Android phones and iPhones to be used as security keys.

Dark Reading: Attacks/Breaches
5 Years That Altered the Ransomware Landscape

WannaCry continues to be a reminder of the challenges that organizations face dealing with the ransomware threat.

Dark Reading: Attacks/Breaches
Known macOS Vulnerabilities Led Researcher to Root Out New Flaws

Researcher shares how he unearthed newer bugs in Apple's operating system by closer scrutiny of previous research, including vulnerabilities that came out of the Pwn2Own competition.

Dark Reading: Attacks/Breaches
How Can Your Business Defend Itself Against Fraud-as-a-Service?

By understanding how FaaS works and following best practices to prevent it, your business can protect its customers, revenue, and brand reputation.

Passive/Active Information Gathering: Subdomain Enumeration

This post is design to share some of the information I’ve learned while working through the Information Gathering- Web Edition module in…Continue reading on Medium »
Read more...

How To Handle The Aftermath Of A Cyber Attack

Once a breach or an attack happens, the company should try to resolve the  issue in 30 days or less. During that time, the team should…Continue reading on Medium »
Read more...

Hacking on Medium
Convert Veracode XML Report to Excel Report

https://cdn-images-1.medium.com/max/1242/1*ax7eI3t5AcAivjtzlQ6DtA.png
Hello Everyone,

Continue reading on Medium »

Hacking on Medium
From zero to hero — JWT

https://cdn-images-1.medium.com/max/1169/1*cAxQN00PzaZABSHIdWcbkQ.png
Introduction

Continue reading on Medium »

Hacking on Medium
Invoca Capture the Flag (CTF) 2022

https://cdn-images-1.medium.com/max/658/1*6hb_mYdB6bFofxB0qmcW8g.png
A perspective from a first-time CTF host, novice penetration tester, and Security professional

Continue reading on Medium »

Hacking on Medium
Nmap everything to know.

In this article we will try to understand how to use nmap without big-theory theards. We need only to use it correctly without academic…

Continue reading on Medium »

Hacking on Medium
Anonymous Playground | Portguês-Brasil

https://cdn-images-1.medium.com/max/1200/1*C8ehUTrhmKaPDLsji0aiIA.png
Mais um lab interessante, este é mais um CTF gameficado, com uma temática do grupo Hacker Anonymous, uma simulação de que o jogador do CTF…

Continue reading on Medium »

Hacking on Medium
Hacking like a Hipster

https://cdn-images-1.medium.com/max/600/1*IQeYOoUvaOUJ-pGb4wwXKw.png
Ever wanted to hack things from your iPad. Well read all about it here!

Continue reading on Medium »