M365 (Microsoft Office 365) Pentesting

Enumeration

Password Spraying

We may spray user passwords with open-source tools as below.

GitHub - dafthack/MFASweep: A tool for checking if MFA is enabled on multiple Microsoft ServicesGitHub

GitHub - 0xZDH/o365spray: Username enumeration and password spraying tool aimed at Microsoft O365.GitHub