Details About Go365
Go365 by optiv, is a tool designed to help security professionals and researchers perform user enumeration* and password guessing attacks on organizations that use Office365. Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the endpoint responds with an Azure AD Authentication and Authorization code. This code is then processed by Go365 and the result is printed to screen or an output file.
- User enumeration is performed in conjunction with a password guess attempt. Thus, there is no specific flag or functionality to perform only user enumeration. Instead, conduct your first password guessing attack, then parse the results for valid users.
Notes:
- This tool might not work on all domains that utilize o365. Tests show that it works with most federated domains. Some domains will only report valid users even if a valid password is also provided. Your results may vary!
- The domains this tool was tested on showed that it did not actually lock out accounts after multiple password failures. Your results may vary!
- This tool is intended to be used by security professionals that are authorized to “attack” the target organization’s o365 instance.
Installation Steps
– Pre-compiled package
Download a pre-compiled binary for your OS HERE.
– Clone and Compile Manually
- Install Go.
- Clone the repo.
- Navigate to the repo and compile ya dingus.
$ go build Go365.go - Run the resulting binary