来源： EvilMist Toolkit - Invoke-EntraEnum.ps1 - https://github.com/Logisek/EvilMist
使用公共 API 发现租户信息。
从 azmap.dev 服务检索租户详细信息。
# Replace DOMAIN with target domain (e.g., example.com)
curl -s "https://azmap.dev/api/tenant?domain=DOMAIN&extract=true"
响应包含： tenantId、displayName、countryCode
检索包括令牌端点在内的 OpenID Connect 配置。
# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/DOMAIN/v2.0/.well-known/openid-configuration"
响应包含： token_endpoint、authorization_endpoint、jwks_uri、issuer
检索域命名空间和联合配置。
# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=enum@DOMAIN&json=1"
响应包含：
NameSpaceType - “Managed”或“Federated”AuthURL - 联合身份验证 URL（如果已联合）CloudInstanceName - 云实例（例如“microsoftonline.com”）FederationBrandName - 组织品牌名称DomainName - 已验证域检查用户是否存在于 Azure AD 中。根据用户存在情况返回不同的代码。
# Replace EMAIL with target email address
curl -s -X POST "https://login.microsoftonline.com/common/GetCredentialType" \
-H "Content-Type: application/json" \
-d '{
"Username": "EMAIL",
"isOtherIdpSupported": true,
"checkPhones": false,
"isRemoteNGCSupported": true,
"isCookieBannerShown": false,
"isFidoSupported": true,
"originalRequest": "",
"country": "US",
"forceotclogin": false,
"isExternalFederationDisallowed": false,
"isRemoteConnectSupported": false,
"federationFlags": 0,
"isSignup": false,
"flowToken": "",
"isAccessPassSupported": true
}'
IfExistsResult 代码：
0 = 用户存在（Azure IdP）1 = 用户不存在2 = 无效请求4 = 服务器错误5 = 用户存在（联合 IdP）6 = 用户存在（外部非 MS IdP）针对 Azure/M365 相关记录的 DNS 查询。可使用 dig、nslookup 或 host 命令。
# Main domain CNAME
dig CNAME DOMAIN
# Autodiscover CNAME
dig CNAME autodiscover.DOMAIN
dig CNAME lyncdiscover.DOMAIN
dig CNAME sip.DOMAIN
dig TXT DOMAIN
dig SRV _ldap._tcp.DOMAIN
dig SRV _kerberos._tcp.DOMAIN
dig SRV _autodiscover._tcp.DOMAIN
dig SRV _sip._tls.DOMAIN
dig SRV _sipfederationtls._tcp.DOMAIN
dig MX DOMAIN
完全不可检测 - 不生成任何审计日志。
通过探测用户的 OneDrive 个人网站 URL 来检查用户是否存在。
# Replace TENANT with tenant name (e.g., example)
# Replace USERPATH with email formatted as: user_domain_com (@ and . replaced with _)
# Example: [email protected] becomes john_doe_example_com
curl -s -o /dev/null -w "%{http_code}" -I \
"https://TENANT-my.sharepoint.com/personal/USERPATH/_layouts/15/onedrive.aspx"
状态代码：
200 = 用户存在，OneDrive 可访问401/403 = 用户存在，访问被拒绝404 = 用户不存在curl -s -o /dev/null -w "%{http_code}" -I \
"https://example-my.sharepoint.com/personal/john_doe_example_com/_layouts/15/onedrive.aspx"
检索包括签名证书和令牌端点在内的联合元数据。
# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/DOMAIN/FederationMetadata/2007-06/FederationMetadata.xml"
响应包含（XML）：
检测桌面 SSO（无缝单一登录）是否已启用。
# Replace DOMAIN with target domain
curl -s "https://login.microsoftonline.com/getuserrealm.srf?login=user@DOMAIN&json=1"
查找： DesktopSsoEnabled: true
# Replace TENANT_ID with the tenant GUID
curl -s -o /dev/null -w "%{http_code}" \
"https://autologon.microsoftazuread-sso.com/TENANT_ID/winauth/trust/2005/usernamemixed"
发现与租户关联的 Azure 资源。使用 DNS 解析。
# Replace TENANT with tenant name
# Primary tenant domain
dig A TENANT.onmicrosoft.com
# SharePoint
dig A TENANT.sharepoint.com
# OneDrive
dig A TENANT-my.sharepoint.com
# Azure Blob Storage
dig A TENANT.blob.core.windows.net
# Azure Files
dig A TENANT.file.core.windows.net
# Azure Queue
dig A TENANT.queue.core.windows.net
# Azure Table
dig A TENANT.table.core.windows.net
# Key Vault
dig A TENANT.vault.azure.net
# Azure SQL
dig A TENANT.database.windows.net
# App Service
dig A TENANT.azurewebsites.net
# Kudu/Git Deployment
dig A TENANT.scm.azurewebsites.net
# Cloud Services
dig A TENANT.cloudapp.net
dig A TENANT.cloudapp.azure.com
# Exchange Online Protection
dig A TENANT.mail.protection.outlook.com
# Container Registry
dig A TENANT.azurecr.io
# Redis Cache
dig A TENANT.redis.cache.windows.net
# Service Bus
dig A TENANT.servicebus.windows.net
# Front Door
dig A TENANT.azurefd.net
# Azure AD B2C
dig A TENANT.b2clogin.com
# API Management
dig A TENANT.azure-api.net
# Traffic Manager
dig A TENANT.trafficmanager.net
# HDInsight
dig A TENANT.azurehdinsight.net
# Cosmos DB
dig A TENANT.documents.azure.com
# Cognitive Search
dig A TENANT.search.windows.net
# Cognitive Services
dig A TENANT.cognitiveservices.azure.com
# Common suffixes: dev, prod, staging, test, uat, qa, backup, dr, api, app, web, data
dig A TENANTdev.blob.core.windows.net
dig A TENANTprod.azurewebsites.net
dig A TENANTstaging.vault.azure.net
通过 Autodiscover V2 JSON 端点检查用户是否存在。
# Replace EMAIL with target email address
curl -s -o /dev/null -w "%{http_code}" -L --max-redirs 0 \
"https://autodiscover-s.outlook.com/autodiscover/autodiscover.json?Email=EMAIL&Protocol=Autodiscoverv1"
状态代码：
200 = 用户存在302（重定向）= 用户不存在401/403 = 用户存在（需要认证）用于用户枚举的基于 XML 的旧版 Autodiscover 端点。
# Replace DOMAIN with target domain
# Replace EMAIL with target email address
curl -s -X POST "https://autodiscover.DOMAIN/autodiscover/autodiscover.xml" \
-H "Content-Type: text/xml; charset=utf-8" \
-d '<?xml version="1.0" encoding="utf-8"?>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/requestschema/2006">
<Request>
<EMailAddress>EMAIL</EMailAddress>
<AcceptableResponseSchema>http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a</AcceptableResponseSchema>
</Request>
</Autodiscover>'
响应指示符：
RedirectAddr = 用户存在RedirectUrl = 可能表示用户存在ErrorCode: InvalidUser = 用户不存在ErrorCode: NoError = 用户存在探测 EWS 端点的暴露情况。
# Office 365 EWS endpoints
curl -s -o /dev/null -w "%{http_code}" \
"https://outlook.office365.com/EWS/Exchange.asmx"
curl -s -o /dev/null -w "%{http_code}" \
"https://outlook.office.com/EWS/Exchange.asmx"
# On-premises/custom domain endpoints
# Replace DOMAIN with target domain
curl -s -o /dev/null -w "%{http_code}" \
"https://DOMAIN/EWS/Exchange.asmx"
curl -s -o /dev/null -w "%{http_code}" \
"https://mail.DOMAIN/EWS/Exchange.asmx"
curl -s -o /dev/null -w "%{http_code}" \
"https://ews.DOMAIN/EWS/Exchange.asmx"
表示可用性的状态代码：
200、301、302、307、308 = 可用401、403 = 可用（需要认证）404 = 不可用发现 SharePoint 和 Teams 站点。
# Replace TENANT with tenant name
# Tenant root
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT.sharepoint.com"
# OneDrive root
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT-my.sharepoint.com"
# Common site names to check
# Sites: intranet, portal, hr, finance, it, projects, marketing, sales, support, admin, security, dev
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT.sharepoint.com/sites/intranet"
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT.sharepoint.com/sites/portal"
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT.sharepoint.com/sites/hr"
# Teams sites
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT.sharepoint.com/teams/intranet"
curl -s -o /dev/null -w "%{http_code}" \
"https://TENANT.sharepoint.com/teams/it"
状态代码：
200 = 站点存在且可公开访问401、403 = 站点存在，需要认证301、302、307、308 = 站点存在，正在重定向404 = 站点不存在探测 Lync for Business 发现端点。
# Replace DOMAIN with target domain
curl -s -o /dev/null -w "%{http_code}" \
"https://lyncdiscover.DOMAIN"
curl -s -o /dev/null -w "%{http_code}" \
"https://lyncdiscoverinternal.DOMAIN"
curl -s -o /dev/null -w "%{http_code}" \
"https://sip.DOMAIN"
# MX Records
dig MX DOMAIN
# SPF (TXT record)
dig TXT DOMAIN
# DMARC
dig TXT _dmarc.DOMAIN
# DKIM (common selectors)
dig TXT selector1._domainkey.DOMAIN # Microsoft 365
dig TXT selector2._domainkey.DOMAIN # Microsoft 365
dig TXT google._domainkey.DOMAIN # Google Workspace
dig TXT default._domainkey.DOMAIN
dig TXT dkim._domainkey.DOMAIN
dig TXT mail._domainkey.DOMAIN
dig TXT k1._domainkey.DOMAIN # Mailchimp
dig TXT s1._domainkey.DOMAIN
dig TXT s2._domainkey.DOMAIN
# MTA-STS
dig TXT _mta-sts.DOMAIN
# BIMI
dig TXT default._bimi.DOMAIN
# TLS-RPT
dig TXT _smtp._tls.DOMAIN
# Replace DOMAIN with target domain
curl -s "https://mta-sts.DOMAIN/.well-known/mta-sts.txt"
给定一个租户 ID，发现相关联的资源。
# Replace TENANT_ID with the tenant GUID
# OpenID Configuration (v2.0)
curl -s "https://login.microsoftonline.com/TENANT_ID/v2.0/.well-known/openid-configuration"
# OpenID Configuration (v1.0)
curl -s "https://login.microsoftonline.com/TENANT_ID/.well-known/openid-configuration"
# Graph Tenant Information (requires auth but reveals info in error)
curl -s "https://graph.microsoft.com/v1.0/tenantRelationships/findTenantInformationByTenantId(tenantId='TENANT_ID')"
# Device Code Endpoint
curl -s "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/devicecode"
# OAuth Authorize (reveals tenant branding)
curl -s "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize?client_id=00000000-0000-0000-0000-000000000000&response_type=code&scope=openid"
通过分析已知应用程序 ID 的错误消息来枚举 OAuth 配置。
# Replace TENANT with tenant ID or domain
# Well-known Microsoft Application IDs to test:
# Microsoft Graph
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000003-0000-0000-c000-000000000000&response_type=code&scope=openid"
# Azure AD Graph (Deprecated)
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000002-0000-0000-c000-000000000000&response_type=code&scope=openid"
# Office 365 Exchange Online
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&response_type=code&scope=openid"
# Office 365 SharePoint Online
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_type=code&scope=openid"
# Skype for Business Online
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=00000004-0000-0ff1-ce00-000000000000&response_type=code&scope=openid"
# Azure Service Management API
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=797f4846-ba00-4fd7-ba43-dac1f8f63013&response_type=code&scope=openid"
# Microsoft Azure PowerShell
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=1950a258-227b-4e31-a9cf-717495945fc2&response_type=code&scope=openid"
# Microsoft Azure CLI
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=04b07795-8ddb-461a-bbee-02f9e1bf7b46&response_type=code&scope=openid"
# Microsoft Office
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&response_type=code&scope=openid"
# Microsoft Teams
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=1fec8e78-bce4-4aaf-ab1b-5451cc387264&response_type=code&scope=openid"
# Microsoft Planner
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=9bc3ab49-b65d-410a-85ad-de819febfddc&response_type=code&scope=openid"
# Microsoft Graph Command Line Tools
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=de8bc8b5-d9f9-48b1-a8ad-b748da725064&response_type=code&scope=openid"
# Azure Portal
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=c44b4083-3bb0-49c1-b47d-974e53cbdf3c&response_type=code&scope=openid"
# Microsoft App Access Panel
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=0000000c-0000-0000-c000-000000000000&response_type=code&scope=openid"
# Microsoft Outlook
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=5d661950-3475-41cd-a2c3-d671a3162bc1&response_type=code&scope=openid"
# Microsoft OneDrive
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=eb1cec80-a830-486e-b45b-f57094f163f9&response_type=code&scope=openid"
# SharePoint Online Client
curl -s "https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize?client_id=57fb890c-0dab-4253-a5e0-7188c88b2bb4&response_type=code&scope=openid"
需要分析的 AADSTS 错误代码：
AADSTS700016 = 目录中未找到应用程序AADSTS650057 = 无效资源（应用程序存在但存在配置问题）AADSTS65001 = 需要用户/管理员同意（应用程序存在）AADSTS50011 = 回复 URL 不匹配（应用程序存在）AADSTS90002 = 未找到租户| 方法 | 端点 | HTTP 方法 |
|---|
| 租户信息 | https://azmap.dev/api/tenant?domain={domain}&extract=true | GET |
| OpenID 配置 | https://login.microsoftonline.com/{domain}/v2.0/.well-known/openid-configuration | GET |
| 域领域 | https://login.microsoftonline.com/getuserrealm.srf?login=user@{domain}&json=1 | GET |
| 用户枚举 | https://login.microsoftonline.com/common/GetCredentialType | POST |
| OneDrive 枚举 | https://{tenant}-my.sharepoint.com/personal/{user_path}/_layouts/15/onedrive.aspx | HEAD |
| 联合元数据 | https://login.microsoftonline.com/{domain}/FederationMetadata/2007-06/FederationMetadata.xml | GET |
| Autologon | https://autologon.microsoftazuread-sso.com/{tenant_id}/winauth/trust/2005/usernamemixed | GET |
| Autodiscover V2 | https://autodiscover-s.outlook.com/autodiscover/autodiscover.json?Email={email}&Protocol=Autodiscoverv1 | GET |
| Autodiscover V1 | https://autodiscover.{domain}/autodiscover/autodiscover.xml | POST |
| EWS | https://outlook.office365.com/EWS/Exchange.asmx | GET |
| SharePoint | https://{tenant}.sharepoint.com/sites/{site} | GET |
| Lync | https://lyncdiscover.{domain} | GET |
| MTA-STS 策略 | https://mta-sts.{domain}/.well-known/mta-sts.txt | GET |
| OAuth 探测 | https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?client_id={app_id}&response_type=code&scope=openid | GET |