Azure

Cloud Asset Discovery

https://login.microsoftonline.com/[email protected]&xml=1
https://login.microsoftonline.com/<target domain>/v2.0/.well-known/openid-configuration

User Enumeration

• Perform user enumeration on Azure at: https://login.microsoft.com/common/oauth2/token

• Detect invalid users while password spraying with: https://github.com/dafthack/MSOLSpray

• Azure Smart Lockout (IP Ban) - Bypass with FireProx + MSOLSpray to rotate IP addresses: https://github.com/ustayready/fireprox

• May be able to enumerate users via OneDrive: https://github.com/nyxgeek/onedrive_user_enum

• Scrape linkedin, and other services, create valid emails, enumerate all the users: https://github.com/initstring/linkedin2username

Microsoft MFA Options

GitHub - dafthack/MFASweep: A tool for checking if MFA is enabled on multiple Microsoft ServicesGitHub

Microsoft Authenticator
OAuth Hardware Token (Fido)
SMS
Voice Call

Cloud_enum

Enumerate public resources in AWS, Azure, and Google Cloud.

GitHub - initstring/cloud_enum: Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.GitHub

GitHub - dafthack/CloudPentestCheatsheets: This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.GitHub