Show HN: Enumerate Office365/Azure Domains

https://azure-enum.lolware.net/

by technion • 2 years ago

33 6 2 years ago

azure-enum.lolware.net

mdaniel• 2 years ago

since this seems to be some kind of brag site without any substance, there is a relevant gist that is the "local" version of this behavior https://gist.github.com/Mike-Crowley/5da3f3fd69519f06866d580... ("Query GetFederationInformation from AutoDiscover anonymously") and the official docs https://learn.microsoft.com/en-us/openspecs/exchange_server_...

technion2• 2 years ago

If you're interested in the local version or a "how does it work", I wrote this Ruby gem years ago for this functionality, which has been useful in a range of penetration testing engagements where "the Azure tenant" is within scope.

https://rubygems.org/gems/azure_enum

The Gem is virtually unused with the only feedback I had being "eww Ruby", so I made a web interface for an AWS lambda function. Perhaps some non tech people would be interested in seeing what companies work together behind the scenes.

There's no intention of "bragging" here on a page that doesn't name me or any company or include any usage analytics.

lloydatkinson2• 2 years ago

That URL field is awful on mobile. I can’t understand why people don’t use the correct attributes to prevent URLs being “helpfully” spell corrected into something else.

technion2• 2 years ago

This is in the "I'm not a frontend person, I've literally never heard of any correct attributes beyond the ones I copied from the React-hook-form examples" category.

If you can point to a specific change, send it to an issue and I'll do it:

https://github.com/technion/azure-enum-frontend

lloydatkinson2• 2 years ago

So we are just [flagging] everything now?

rootsudo• 2 years ago

You can just pull dns records and see for yourself. It’s funny. It’s like saying water is wet. You can also see what services are enabled on that domain - and.. maybe rven other things!

Show HN: Enumerate Office365/Azure Domains

Related Stories