m365-entra-attack

What problem does it solve?

It helps you determine whether M365/Entra credentials are valid and whether Conditional Access blocks usable authentication paths, so you can produce defensible findings instead of guesswork.

Core Features & Use Cases

• User/tenant discovery and recon for Entra attack surfaces: enumerate tenant context using owned domains and identify federation posture, SharePoint/OneDrive provisioning, and service-specific signals.
• Credential validation with AADSTS evidence: interpret Entra response codes to confirm password correctness even when CA blocks token issuance, including Smart Lockout-safe pacing and lockout differential detection for active external spraying.
• Conditional Access bypass-path assessment (where applicable): explore ROPC plus SAML SSO browser flows to capture definitive CA-block evidence and document CA policy identifiers as defender breadcrumbs.

Quick Start

Use the skill to run a single-attempt-per-user M365 credential validation plan against a target tenant, then corroborate any CA-block outcomes with an interactive SAML SSO flow.