Usage: spray365.py generate normal [OPTIONS]

Generate a vanilla (normal) execution plan

Options:
-ep, --execution_plan           File path where execution plan should be saved  [required]
-d, --domain                    Office 365 domain to authenticate against  [required]
--delay                         Delay in seconds to wait between authentication attempts  [default: 30]
-mD, --min_loop_delay           Minimum time to wait between authentication attempts for a given user. This option takes into account the time one spray iteration will take, so a pre-authentication delay may not occur every time  [default: 0]

User options:
  -u, --user_file               File containing usernames to spray (one per line without domain)  [required]

Password options: [mutually_exclusive, required]
  -p, --password                Password to spray
  -pf, --password_file          File containing passwords to spray (one per line)
  --passwords_in_userfile       Extract passwords from user_file (colon separated)

Authentication options:
  -cID, --aad_client            Client ID used during authentication. Leave unspecified for random selection, or provide a comma-separated string
  -eID, --aad_endpoint          Endpoint ID used during authentication. Leave unspecified for random selection, or provide a comma-separated string

User Agent options: [mutually_exclusive]
  -cUA, --custom_user_agent     Set custom user agent for authentication requests
  -rUA, --random_user_agent     Randomize user agent for authentication requests  [default: True]

Shuffle options: [all_or_none]
  -S, --shuffle_auth_order      Shuffle order of authentication attempts so that each iteration (User1:Pass1, User2:Pass1, User3:Pass1) will be sprayed in a random order with a random arrangement of passwords, e.g (User4:Pass16, User13:Pass25, User19:Pass40). Be aware this option introduces the possibility that the time between consecutive authentication attempts for a given user may occur DELAY seconds apart. Consider using the-mD/--min_loop_delay option to enforce a minimum delay between authentication attempts for any given user.
  -SO, --shuffle_optimization_attempts [default: 10]

-h, --help                      Show this message and exit.

Usage: spray365.py generate audit [OPTIONS]

Generate an execution plan to identify flaws in MFA / Conditional Access Policies. This works best with with known credentials.

Options:
-ep, --execution_plan           File path where execution plan should be saved  [required]
-d, --domain                    Office 365 domain to authenticate against  [required]
--delay                         Delay in seconds to wait between authentication attempts  [default: 30]
-mD, --min_loop_delay           Minimum time to wait between authentication attempts for a given user. This option takes into account the time one spray iteration will take, so a pre-authentication delay may not occur every time  [default: 0]

User options:
  -u, --user_file               File containing usernames to spray (one per line without domain)  [required]

Password options: [mutually_exclusive, required]
  -p, --password                Password to spray
  -pf, --password_file          File containing passwords to spray (one per line)
  --passwords_in_userfile       Extract passwords from user_file (colon separated)

Shuffle options: [all_or_none]
  -S, --shuffle_auth_order      Shuffle order of authentication attempts so that each iteration (User1:Pass1, User2:Pass1, User3:Pass1) will be sprayed in a random order with a random arrangement of passwords, e.g (User4:Pass16, User13:Pass25, User19:Pass40). Be aware this option introduces the possibility that the time between consecutive authentication attempts for a given user may occur DELAY seconds apart. Consider using the-mD/--min_loop_delay option to enforce a minimum delay between authentication attempts for any given user.
  -SO, --shuffle_optimization_attempts [default: 10]

-h, --help                      Show this message and exit.

Usage: spray365.py spray [OPTIONS]

Password spray user accounts using an existing execution plan

Options:
-ep, --execution_plan         File path to execution plan  [required]
-l, --lockout                 Number of account lockouts to observe before aborting spraying session (disable with 0)  [default: 5]
-R, --resume_index            Resume spraying passwords from this position in the execution plan  [x>=1]
-i, --ignore_success          Ignore successful authentication attempts for users and continue to spray credentials. Setting this flag will enable spraying credentials for users even if Spray365 has already identified valid credentials.

Proxy options: [all_or_none]
  -x, --proxy                 HTTP Proxy URL (format: http[s]://proxy.address:port)
  -k, --insecure              Disable HTTPS certificate verification

-h, --help                    Show this message and exit.

Usage: spray365.py review [OPTIONS] RESULTS

View data from password spraying results to identify valid accounts and more

Options:
--show_invalid_creds
--show_invalid_users

-h, --help            Show this message and exit.