m365-entra-attack

Test M365/Entra credentials and map CA policy outcomes via ROPC and SAML SSO flows.

3.3k|507|Updated May 5, 2026

Search Tags:#playwright #saml #credential-testing #conditional-access #m365 #entra #ropc

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill m365-entra-attack-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: m365-entra-attack
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/m365-entra-attack
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill m365-entra-attack-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams and red-team operators simulate and map credential-stuffing, CA policy behavior, and SSO flows within Microsoft 365/Entra to identify valid credentials and policy gaps, reducing risk and improving detection readiness.

Core Features & Use Cases

Tenant reconnaissance and Entra AADSTS code mapping for credential testing across multiple domains.
Demonstrations of ROPC and SAML SSO flows, with CA policy evaluation and lockout behavior for incident response planning.
Playwright/ Burp templates and reference workflows for end-to-end attack chain testing and evidence collection.

Quick Start

Run a credential-testing scenario against M365/Entra to map CA policies and detect valid credentials.

Frequently Asked Questions about m365-entra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test M365 Entra credentials without triggering lockouts?▼

To test M365 Entra credentials safely, you apply controlled password testing with strict rate limiting and state tracking. This identifies valid credentials while mapping lockout thresholds and Conditional Access policy outcomes.

What are Entra AADSTS codes and how do they map to Conditional Access policies?▼

Entra AADSTS codes are authentication error codes returned during login attempts. Mapping these codes during credential testing reveals MFA requirements, device posture checks, and specific Conditional Access policy triggers.

Can I use Playwright to automate ROPC and SAML SSO flow testing in M365?▼

Yes, you can use Playwright templates to automate ROPC and SAML SSO flow testing in M365. This captures SAML flow outcomes and evaluates Conditional Access responses for incident response planning.

What is the best way to simulate credential stuffing against Entra ID tenants?▼

The best way to simulate credential stuffing against Entra ID is running controlled password spray scenarios that track AADSTS codes and CA policy evaluations. This maps valid credentials and policy gaps without causing lockouts.

Does this credential testing approach work with multiple Entra domains?▼

Yes, this approach performs tenant reconnaissance across multiple Entra domains. It maps AADSTS codes and CA policy behavior for each domain to identify valid credentials and policy gaps comprehensively.