Discovery

Even if we only know the domain name or email addresses of the target organization

• defcorphq

We can extract some interesting information:

– If the target organization uses Azure tenant

– Tenant ID

– Tenant name

– Authentication type (Federation or not)

– Domains

– Azure Services used by the target organization

– Guess email IDs

Context	Command	Example Output
Get if Azure tenant is in use, tenant name and Federation	https://login.microsoftonline.com/getuserrealm.srf?login=%5bUSERNAME@DOMAIN%5d&xml=1
Get the Tenant ID	https://login.microsoftonline.com/[DOMAIN]/.well- known/openid-configuration
Validate Email ID by sending requests to	https://login.microsoftonline.com/common/GetCredentialType

AADInternals

Use AADInternals tool (a PowerShell module that we will use for multiple attacks against AzureAD) from https://github.com/Gerenios/AADInternals for Recon.

Import-Module C:\AzAD\Tools\AADInternals\AADInternals.psd1 -Verbose

1

Get tenant name, authentication, brand name (usually same as directory name) and domain name. The username can be even a non-existent one in the defcorphq tenant.

Get-AADIntLoginInformation -UserName [e-mail]

2

Get tenant ID

Get-AADIntTenantID -Domain defcorphq.onmicrosoft.com

3

Get tenant domains

Get-AADIntTenantDomains -Domain defcorphq.onmicrosoft.com
Get-AADIntTenantDomains -Domain deffin.onmicrosoft.com
Get-AADIntTenantDomains -Domain microsoft.com

4

Get all information

Invoke-AADIntReconAsOutsider -DomainName defcorphq.onmicrosoft.com

o365creeper

We can use o365creeper (https://github.com/LMGsec/o365creeper) to check if an email ID belongs to a tenant. It makes requests to the GetCredentialType API that we saw earlier.

Examples:
o365creeper.py -e [e-mail]
o365creeper.py -f emails.txt
o365creeper.py -f emails.txt -o validemails.txt

This tool is still using Python 2.7

MicroBurst

Azure services are available at specific domains and subdomains. We can enumerate if the target organization is using any of the services by looking for such subdomains. The tool that we will use for this is MicroBurst (https://github.com/NetSPI/MicroBurst). Microburst is a useful tool for security assessment of Azure. It uses Az, AzureAD, AzurRM and MSOL tools and additional REST API calls!

Import-Module C:\AzAD\Tools\MicroBurst\MicroBurst.psm1 -Verbose

1

Enumerate all subdomains for an organization specified using the '-Base' parameter:

Invoke-EnumerateAzureSubDomains -Base defcorphq -Verbose