Note: This repository is no longer being developed

msspray.py

MSSpray is used to conduct password spray attacks against Azure AD as well as validate the implementation of MFA on Azure and Office 365 endpoints

  ------------------------------------------------------------
 |    ;---<<<<,______________________________________________ |
 |   _|_     /        /  ____/  ____/  __ /  __ / __  /  /  / |
 |  /   \   /  /  /  /____  /____  /  ___/   __/     / \   /  |
 |  |   |  /__/__/__/______/______/__/  /__/\_\__/__/  /__/   |
 |  |___|                                                     |
  ------------------------------------------------------------

Usage

Perform a password spray against the selected endpoint with the supplied userfile (one email address per line) and password and the option to stop on success (stop):

python3 msspray.py spray <userfile> <password> <endpoint_selection> <stop/blank>

Check each endpoint for authentication with a valid username and password:

python3 msspray.py validate <username> <password>

Endpoints (Default is 1)

Examples

spray against https://graph.windows.net, stopping on first successful login

python3 msspray.py spray users.txt Spring2020 1 stop

spray against https://management.core.windows.net

python3 msspray.py spray users.txt Spring2020 4

check all endpoints using valid account

python3 msspray.py validate [email protected] ReallyBadPass

Blog Post: https://sra.io/blog/msspray-wait-how-many-endpoints-dont-have-mfa/

For any questions, feel free to reach out to me on Twitter @__TexasRanger