Enumerazione non autenticata di Microsoft Entra ID (Azure AD)

Fonte: EvilMist Toolkit - Invoke-EntraEnum.ps1 - https://github.com/Logisek/EvilMist

1. Individuazione del Tenant (-TenantInfo)

Individua le informazioni sul tenant utilizzando API pubbliche.

1.1 azmap.dev API

Recupera i dettagli del tenant dal servizio azmap.dev.

# Replace DOMAIN with target domain (e.g., example.com)
curl -s "https://azmap.dev/api/tenant?domain=DOMAIN&extract=true"

La risposta contiene: tenantId, displayName, countryCode

1.2 Configurazione OpenID

Recupera la configurazione OpenID Connect inclusi gli endpoint dei token.

# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/DOMAIN/v2.0/.well-known/openid-configuration"

La risposta contiene: token_endpoint, authorization_endpoint, jwks_uri, issuer

2. Informazioni sul Realm del Dominio (-DomainRealm)

Recupera il namespace del dominio e la configurazione della federazione.

# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=enum@DOMAIN&json=1"

La risposta contiene:

NameSpaceType - "Managed" o "Federated"
AuthURL - URL di autenticazione della federazione (se federato)
CloudInstanceName - Istanza cloud (ad es., "microsoftonline.com")
FederationBrandName - Nome del branding dell'organizzazione
DomainName - Dominio verificato

3. Enumerazione degli Utenti tramite GetCredentialType (-UserEnum)

Verifica se un utente esiste in Azure AD. Restituisce codici diversi in base all'esistenza dell'utente.

# Replace EMAIL with target email address
curl -s -X POST "https://login.microsoftonline.com/common/GetCredentialType" \
  -H "Content-Type: application/json" \
  -d '{
    "Username": "EMAIL",
    "isOtherIdpSupported": true,
    "checkPhones": false,
    "isRemoteNGCSupported": true,
    "isCookieBannerShown": false,
    "isFidoSupported": true,
    "originalRequest": "",
    "country": "US",
    "forceotclogin": false,
    "isExternalFederationDisallowed": false,
    "isRemoteConnectSupported": false,
    "federationFlags": 0,
    "isSignup": false,
    "flowToken": "",
    "isAccessPassSupported": true
  }'

Codici IfExistsResult:

0 = L'utente esiste (IdP Azure)
1 = L'utente non esiste
2 = Richiesta non valida
4 = Errore del server
5 = L'utente esiste (IdP federato)
6 = L'utente esiste (IdP esterno non MS)

4. Ricognizione DNS (-DnsEnum)

Query DNS per i record relativi ad Azure/M365. Utilizzare i comandi dig, nslookup o host.

4.1 Record CNAME

# Main domain CNAME
dig CNAME DOMAIN

# Autodiscover CNAME
dig CNAME autodiscover.DOMAIN
dig CNAME lyncdiscover.DOMAIN
dig CNAME sip.DOMAIN

4.2 Record TXT/SPF

dig TXT DOMAIN

4.3 Record SRV

dig SRV _ldap._tcp.DOMAIN
dig SRV _kerberos._tcp.DOMAIN
dig SRV _autodiscover._tcp.DOMAIN
dig SRV _sip._tls.DOMAIN
dig SRV _sipfederationtls._tcp.DOMAIN

4.4 Record MX

dig MX DOMAIN

5. Enumerazione degli Utenti OneDrive (-OneDriveEnum)

Completamente non rilevabile - Nessun log di controllo generato.

Verifica se un utente esiste interrogando l'URL del sito personale OneDrive dell'utente.

# Replace TENANT with tenant name (e.g., example)
# Replace USERPATH with email formatted as: user_domain_com (@ and . replaced with _)
# Example: [email protected] becomes john_doe_example_com

curl -s -o /dev/null -w "%{http_code}" -I \
  "https://TENANT-my.sharepoint.com/personal/USERPATH/_layouts/15/onedrive.aspx"

Codici di stato:

200 = L'utente esiste, OneDrive accessibile
401/403 = L'utente esiste, accesso negato
404 = L'utente non esiste

Esempio per l'utente [email protected]:

curl -s -o /dev/null -w "%{http_code}" -I \
  "https://example-my.sharepoint.com/personal/john_doe_example_com/_layouts/15/onedrive.aspx"

6. Metadati della Federazione (-FederationMeta)

Recupera i metadati della federazione, inclusi i certificati di firma e gli endpoint dei token.

# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/DOMAIN/FederationMetadata/2007-06/FederationMetadata.xml"

La risposta contiene (XML):

ID dell'entità
Certificati di firma X509
Endpoint dei token
Formati NameID
Tipi di claim
Informazioni sul server ADFS (se federato)

7. Rilevamento Seamless SSO (-SeamlessSSO)

Rileva se l'SSO desktop (Seamless Single Sign-On) è abilitato.

7.1 Verifica della Configurazione SSO

# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=user@DOMAIN&json=1"

Cercare: DesktopSsoEnabled: true

7.2 Test dell'Endpoint Autologon (se SSO abilitato)

# Replace TENANT_ID with the tenant GUID
curl -s -o /dev/null -w "%{http_code}" \
  "https://autologon.microsoftazuread-sso.com/TENANT_ID/winauth/trust/2005/usernamemixed"

8. Enumerazione dei Sottodomini Azure (-SubdomainEnum)

Individua le risorse Azure associate a un tenant. Utilizza la risoluzione DNS.

Sottodomini Azure Principali da Verificare:

# Replace TENANT with tenant name

# Primary tenant domain
dig A TENANT.onmicrosoft.com

# SharePoint
dig A TENANT.sharepoint.com

# OneDrive
dig A TENANT-my.sharepoint.com

# Azure Blob Storage
dig A TENANT.blob.core.windows.net

# Azure Files
dig A TENANT.file.core.windows.net

# Azure Queue
dig A TENANT.queue.core.windows.net

# Azure Table
dig A TENANT.table.core.windows.net

# Key Vault
dig A TENANT.vault.azure.net

# Azure SQL
dig A TENANT.database.windows.net

# App Service
dig A TENANT.azurewebsites.net

# Kudu/Git Deployment
dig A TENANT.scm.azurewebsites.net

# Cloud Services
dig A TENANT.cloudapp.net
dig A TENANT.cloudapp.azure.com

# Exchange Online Protection
dig A TENANT.mail.protection.outlook.com

# Container Registry
dig A TENANT.azurecr.io

# Redis Cache
dig A TENANT.redis.cache.windows.net

# Service Bus
dig A TENANT.servicebus.windows.net

# Front Door
dig A TENANT.azurefd.net

# Azure AD B2C
dig A TENANT.b2clogin.com

# API Management
dig A TENANT.azure-api.net

# Traffic Manager
dig A TENANT.trafficmanager.net

# HDInsight
dig A TENANT.azurehdinsight.net

# Cosmos DB
dig A TENANT.documents.azure.com

# Cognitive Search
dig A TENANT.search.windows.net

# Cognitive Services
dig A TENANT.cognitiveservices.azure.com

Esempi di Permutazione:

# Common suffixes: dev, prod, staging, test, uat, qa, backup, dr, api, app, web, data
dig A TENANTdev.blob.core.windows.net
dig A TENANTprod.azurewebsites.net
dig A TENANTstaging.vault.azure.net

9. Enumerazione Autodiscover V2 (-AutodiscoverEnum)

Verifica l'esistenza dell'utente tramite l'endpoint JSON Autodiscover V2.

# Replace EMAIL with target email address
curl -s -o /dev/null -w "%{http_code}" -L --max-redirs 0 \
  "https://autodiscover-s.outlook.com/autodiscover/autodiscover.json?Email=EMAIL&Protocol=Autodiscoverv1"

Codici di stato:

200 = L'utente esiste
302 (reindirizzamento) = L'utente non esiste
401/403 = L'utente esiste (autenticazione richiesta)

10. Enumerazione Autodiscover V1 (-AutodiscoverV1Enum)

Endpoint Autodiscover legacy basato su XML per l'enumerazione degli utenti.

# Replace DOMAIN with target domain
# Replace EMAIL with target email address

curl -s -X POST "https://autodiscover.DOMAIN/autodiscover/autodiscover.xml" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -d '<?xml version="1.0" encoding="utf-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
  <Request>
    <EMailAddress>EMAIL</EMailAddress>
    <AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
  </Request>
</Autodiscover>'

Indicatori della risposta:

RedirectAddr nella risposta = L'utente esiste
RedirectUrl nella risposta = Può indicare l'esistenza
ErrorCode: InvalidUser = L'utente non esiste
ErrorCode: NoError = L'utente esiste

11. Sonda Exchange Web Services (EWS) (-EwsProbe)

Interroga gli endpoint EWS per verificarne l'esposizione.

# Office 365 EWS endpoints
curl -s -o /dev/null -w "%{http_code}" \
  "https://outlook.office365.com/EWS/Exchange.asmx"

curl -s -o /dev/null -w "%{http_code}" \
  "https://outlook.office.com/EWS/Exchange.asmx"

# On-premises/custom domain endpoints
# Replace DOMAIN with target domain
curl -s -o /dev/null -w "%{http_code}" \
  "https://DOMAIN/EWS/Exchange.asmx"

curl -s -o /dev/null -w "%{http_code}" \
  "https://mail.DOMAIN/EWS/Exchange.asmx"

curl -s -o /dev/null -w "%{http_code}" \
  "https://ews.DOMAIN/EWS/Exchange.asmx"

Codici di stato che indicano la disponibilità:

200, 301, 302, 307, 308 = Disponibile
401, 403 = Disponibile (autenticazione richiesta)
404 = Non disponibile

12. Individuazione di SharePoint/Teams (-SharePointEnum)

Individua i siti SharePoint e Teams.

# Replace TENANT with tenant name

# Tenant root
curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT.sharepoint.com"

# OneDrive root
curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT-my.sharepoint.com"

# Common site names to check
# Sites: intranet, portal, hr, finance, it, projects, marketing, sales, support, admin, security, dev

curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT.sharepoint.com/sites/intranet"

curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT.sharepoint.com/sites/portal"

curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT.sharepoint.com/sites/hr"

# Teams sites
curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT.sharepoint.com/teams/intranet"

curl -s -o /dev/null -w "%{http_code}" \
  "https://TENANT.sharepoint.com/teams/it"

Codici di stato:

200 = Il sito esiste ed è accessibile pubblicamente
401, 403 = Il sito esiste, autenticazione richiesta
301, 302, 307, 308 = Il sito esiste, reindirizzamento in corso
404 = Il sito non esiste

13. Individuazione Lync (-LyncProbe)

Interroga gli endpoint di individuazione di Lync for Business.

# Replace DOMAIN with target domain

curl -s -o /dev/null -w "%{http_code}" \
  "https://lyncdiscover.DOMAIN"

curl -s -o /dev/null -w "%{http_code}" \
  "https://lyncdiscoverinternal.DOMAIN"

curl -s -o /dev/null -w "%{http_code}" \
  "https://sip.DOMAIN"

14. Enumerazione della Sicurezza Avanzata della Posta (-MailEnum)

14.1 Record DNS (usare dig/nslookup)

# MX Records
dig MX DOMAIN

# SPF (TXT record)
dig TXT DOMAIN

# DMARC
dig TXT _dmarc.DOMAIN

# DKIM (common selectors)
dig TXT selector1._domainkey.DOMAIN  # Microsoft 365
dig TXT selector2._domainkey.DOMAIN  # Microsoft 365
dig TXT google._domainkey.DOMAIN     # Google Workspace
dig TXT default._domainkey.DOMAIN
dig TXT dkim._domainkey.DOMAIN
dig TXT mail._domainkey.DOMAIN
dig TXT k1._domainkey.DOMAIN         # Mailchimp
dig TXT s1._domainkey.DOMAIN
dig TXT s2._domainkey.DOMAIN

# MTA-STS
dig TXT _mta-sts.DOMAIN

# BIMI
dig TXT default._bimi.DOMAIN

# TLS-RPT
dig TXT _smtp._tls.DOMAIN

14.2 Policy MTA-STS (HTTP)

# Replace DOMAIN with target domain
curl -s "https://mta-sts.DOMAIN/.well-known/mta-sts.txt"

15. Individuazione delle Risorse tramite Tenant ID (-TenantReverse)

Dato un Tenant ID, individua le risorse associate.

# Replace TENANT_ID with the tenant GUID

# OpenID Configuration (v2.0)
curl -s "https://login.microsoftonline.com/TENANT_ID/v2.0/.well-known/openid-configuration"

# OpenID Configuration (v1.0)
curl -s "https://login.microsoftonline.com/TENANT_ID/.well-known/openid-configuration"

# Graph Tenant Information (requires auth but reveals info in error)
curl -s "https://graph.microsoft.com/v1.0/tenantRelationships/findTenantInformationByTenantId(tenantId='TENANT_ID')"

# Device Code Endpoint
curl -s "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/devicecode"

# OAuth Authorize (reveals tenant branding)
curl -s "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize?client_id=00000000-0000-0000-0000-000000000000&response_type=code&scope=openid"

16. Sonda della Configurazione OAuth (-OAuthProbe)

Enumera la configurazione OAuth tramite l'analisi dei messaggi di errore degli ID di applicazioni note.

# Replace TENANT with tenant ID or domain

# Well-known Microsoft Application IDs to test:

# Microsoft Graph
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000003-0000-0000-c000-000000000000&response_type=code&scope=openid"

# Azure AD Graph (Deprecated)
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000002-0000-0000-c000-000000000000&response_type=code&scope=openid"

# Office 365 Exchange Online
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&response_type=code&scope=openid"

# Office 365 SharePoint Online
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_type=code&scope=openid"

# Skype for Business Online
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000004-0000-0ff1-ce00-000000000000&response_type=code&scope=openid"

# Azure Service Management API
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=797f4846-ba00-4fd7-ba43-dac1f8f63013&response_type=code&scope=openid"

# Microsoft Azure PowerShell
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=1950a258-227b-4e31-a9cf-717495945fc2&response_type=code&scope=openid"

# Microsoft Azure CLI
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=04b07795-8ddb-461a-bbee-02f9e1bf7b46&response_type=code&scope=openid"

# Microsoft Office
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&response_type=code&scope=openid"

# Microsoft Teams
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=1fec8e78-bce4-4aaf-ab1b-5451cc387264&response_type=code&scope=openid"

# Microsoft Planner
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=9bc3ab49-b65d-410a-85ad-de819febfddc&response_type=code&scope=openid"

# Microsoft Graph Command Line Tools
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=de8bc8b5-d9f9-48b1-a8ad-b748da725064&response_type=code&scope=openid"

# Azure Portal
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=c44b4083-3bb0-49c1-b47d-974e53cbdf3c&response_type=code&scope=openid"

# Microsoft App Access Panel
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=0000000c-0000-0000-c000-000000000000&response_type=code&scope=openid"

# Microsoft Outlook
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=5d661950-3475-41cd-a2c3-d671a3162bc1&response_type=code&scope=openid"

# Microsoft OneDrive
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=eb1cec80-a830-486e-b45b-f57094f163f9&response_type=code&scope=openid"

# SharePoint Online Client
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=57fb890c-0dab-4253-a5e0-7188c88b2bb4&response_type=code&scope=openid"

Codici di errore AADSTS da analizzare:

AADSTS700016 = Applicazione non trovata nella directory
AADSTS650057 = Risorsa non valida (l'app esiste ma c'è un problema di configurazione)
AADSTS65001 = Consenso utente/amministratore richiesto (l'app esiste)
AADSTS50011 = URL di risposta non corrispondente (l'app esiste)
AADSTS90002 = Tenant non trovato

Riferimento Rapido: Riepilogo di Tutti gli Endpoint

Note

Nessuna autenticazione richiesta per nessuna di queste richieste
L'enumerazione OneDrive è completamente non rilevabile (nessun log di controllo)
Utilizzare throttling/ritardi appropriati per evitare il rate limiting
Alcuni metodi potrebbero attivare avvisi nei sistemi di monitoraggio della sicurezza
Assicurarsi sempre di disporre della corretta autorizzazione prima di eseguire l'enumerazione

Info Tenant	`https://azmap.dev/api/tenant?domain={domain}&extract=true`	GET
Config OpenID	`https://login.microsoftonline.com/{domain}/v2.0/.well-known/openid-configuration`	GET
Realm del Dominio	`https://login.microsoftonline.com/getuserrealm.srf?login=user@{domain}&json=1`	GET
Enum Utente	`https://login.microsoftonline.com/common/GetCredentialType`	POST
Enum OneDrive	`https://{tenant}-my.sharepoint.com/personal/{user_path}/_layouts/15/onedrive.aspx`	HEAD
Meta Federazione	`https://login.microsoftonline.com/{domain}/FederationMetadata/2007-06/FederationMetadata.xml`	GET
Autologon	`https://autologon.microsoftazuread-sso.com/{tenant_id}/winauth/trust/2005/usernamemixed`	GET
Autodiscover V2	`https://autodiscover-s.outlook.com/autodiscover/autodiscover.json?Email={email}&Protocol=Autodiscoverv1`	GET
Autodiscover V1	`https://autodiscover.{domain}/autodiscover/autodiscover.xml`	POST
EWS	`https://outlook.office365.com/EWS/Exchange.asmx`	GET
SharePoint	`https://{tenant}.sharepoint.com/sites/{site}`	GET
Lync	`https://lyncdiscover.{domain}`	GET
Policy MTA-STS	`https://mta-sts.{domain}/.well-known/mta-sts.txt`	GET
Sonda OAuth	`https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?client_id={app_id}&response_type=code&scope=openid`	GET

AzureADEnumeration

Più Popolari