skills.rest
elementalsouls
elementalsoulsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

m365-entra-attack

Test M365/Entra credentials and map CA policy outcomes via ROPC and SAML SSO flows.

3.3k|507|Updated May 5, 2026
Search Tags:#playwright#saml#credential-testing#conditional-access#m365#entra#ropc
One-click install
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill m365-entra-attack-elementalsouls
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: m365-entra-attack
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/m365-entra-attack
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill m365-entra-attack-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams and red-team operators simulate and map credential-stuffing, CA policy behavior, and SSO flows within Microsoft 365/Entra to identify valid credentials and policy gaps, reducing risk and improving detection readiness.

Core Features & Use Cases

  • Tenant reconnaissance and Entra AADSTS code mapping for credential testing across multiple domains.
  • Demonstrations of ROPC and SAML SSO flows, with CA policy evaluation and lockout behavior for incident response planning.
  • Playwright/ Burp templates and reference workflows for end-to-end attack chain testing and evidence collection.

Quick Start

Run a credential-testing scenario against M365/Entra to map CA policies and detect valid credentials.

Frequently Asked Questions about m365-entra-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test M365 Entra credentials without triggering lockouts?▼

To test M365 Entra credentials safely, you apply controlled password testing with strict rate limiting and state tracking. This identifies valid credentials while mapping lockout thresholds and Conditional Access policy outcomes.

What are Entra AADSTS codes and how do they map to Conditional Access policies?▼

Entra AADSTS codes are authentication error codes returned during login attempts. Mapping these codes during credential testing reveals MFA requirements, device posture checks, and specific Conditional Access policy triggers.

Can I use Playwright to automate ROPC and SAML SSO flow testing in M365?▼

Yes, you can use Playwright templates to automate ROPC and SAML SSO flow testing in M365. This captures SAML flow outcomes and evaluates Conditional Access responses for incident response planning.

What is the best way to simulate credential stuffing against Entra ID tenants?▼

The best way to simulate credential stuffing against Entra ID is running controlled password spray scenarios that track AADSTS codes and CA policy evaluations. This maps valid credentials and policy gaps without causing lockouts.

Does this credential testing approach work with multiple Entra domains?▼

Yes, this approach performs tenant reconnaissance across multiple Entra domains. It maps AADSTS codes and CA policy behavior for each domain to identify valid credentials and policy gaps comprehensively.

Related Skills

Explore More Education & Research Skills→
cmndcntrlcybercmndcntrlcyber
3

m365-entra-attack

Execute Microsoft 365/Entra ID credential attacks and Conditional Access bypass.

Community
Advanced
n4igmen4igme

m365-entra-attack

Identify valid M365/Entra credentials and test defense mechanisms against credential spraying.

Community
Advanced
nrl-ainrl-ai
11

login-flows

Implement reusable Playwright login patterns for username/password, OAuth/SSO, and MFA flows.

Official
Intermediate
Kisilev13Kisilev13

m365-entra-attack

Enumerate users and bypass conditional access in M365/Entra ID environments.

Community
Advanced