trevorspray

Perform password spraying against Microsoft 365 and Azure AD by using this Skill to test username lists against single or multiple passwords. It supports M365, Azure AD, ADFS, and on-prem Active Directory with configurable delay, jitter, and lockout-safe controls.

Password spraying is a credential testing technique that attempts a single password against many user accounts to avoid lockouts. This Skill automates this process to identify weak credentials and enumerate valid user accounts across Microsoft environments.

Yes, you can enumerate valid usernames in Office 365 safely using this Skill's configurable delay, jitter, and lockout-safe controls. These features manage request rates during password spraying to minimize the risk of triggering account lockout policies.

Yes, you need specific input files containing usernames and passwords to test credential vulnerabilities in Azure AD. The Skill also requires selecting specific authentication modules like 'msol' or 'adfs' to target the appropriate Microsoft endpoints.

The best way to automate password strength testing for an Office 365 tenant is using this Skill to perform a controlled password spray. It efficiently tests lists of known user accounts against targeted passwords using threaded attacks with configurable safety controls.

When spraying passwords against on-prem Active Directory, you must consider lockout policies and use configurable delays and jitter to avoid triggering lockouts. The Skill requires specific modules like 'adfs' and proper input files to manage these constraints safely.