{"id":25482,"date":"2022-06-23T11:32:18","date_gmt":"2022-06-23T11:32:18","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=25482"},"modified":"2022-06-23T11:32:21","modified_gmt":"2022-06-23T11:32:21","slug":"ssoh-no","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/ssoh-no\/","title":{"rendered":"SSOh-No : User Enumeration And Password Spraying Tool For Testing Azure AD"},"content":{"rendered":"\n

SSOh-No<\/strong> is designed to enumerate users, password spray and perform brute force attacks against any organisation that utilises Azure AD or O365.<\/p>\n\n\n\n

Generally, this endpoint provides extremely verbose errors which can be leveraged to enumerate users and validate their passwords via brute force\/spraying attacks, while also failing to log any failed authentication attempts.<\/p>\n\n\n\n

This tool is a weaponised version of a PoC demonstrated in the arstechnica research article which discusses the techniques utilised to exploit the endpoint.<\/p>\n\n\n\n

This endpoint is known to Microsoft however, in typical fashion it has been branded a feature, not a bug.<\/p>\n\n\n\n

This endpoint does enforce “smart locking” which can be bypassed by rotating IP.<\/p>\n\n\n\n

<\/a>Why Is This Unique?<\/h3>\n\n\n\n

The SSO Autologon endpoint does not contain logging of any sort bar potentially updating the users “Last Logon” time.<\/p>\n\n\n\n

The following have been tested and contain no logs:<\/p>\n\n\n\n