From 2a4ad61c5f9a93bd1612ab42dae86997db505393 Mon Sep 17 00:00:00 2001 From: adobie Date: Thu, 16 Apr 2020 09:15:36 +0100 Subject: [PATCH 1/2] Fixing detection of O365 use and accomodating edge case where randomised username is valid --- UhOh365.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/UhOh365.py b/UhOh365.py index c662bae..3f7c3a6 100755 --- a/UhOh365.py +++ b/UhOh365.py @@ -58,20 +58,22 @@ def thread_worker(args): if domain not in domain_is_o365.keys(): junk_user = ''.join(random.choice(string.ascii_lowercase + string.digits) for _ in range(20)) r = requests.get('https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/{}@{}?Protocol=Autodiscoverv1'.format(junk_user, domain), headers=headers, verify=args.nossl, allow_redirects=False, proxies=proxies) - if 'outlook.office365.com' in r.text: + if r.status_code == 302 and 'outlook.com/autodiscover' in r.text: + domain_is_o365[domain] = True + elif r.status_code == 200 and 'https://outlook.office.com/api' in r.text: domain_is_o365[domain] = True else: if args.verbose: print("It doesn't look like '{}' uses o365".format(domain)) domain_is_o365[domain] = False r = requests.get('https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/{}?Protocol=Autodiscoverv1'.format(email), headers=headers, verify=args.nossl, allow_redirects=False, proxies=proxies) - if r.status_code == 200 and "X-MailboxGuid" in r.headers.keys(): + if r.status_code == 200: print("VALID: ", email) if args.output is not None: print_queue.put(email) elif r.status_code == 302: if domain_is_o365[domain] and 'outlook.office365.com' not in r.text: - print("VALID: ", email) + print("INVALID: ", email) if args.output is not None: print_queue.put(email) else: From f449bfd519759edeba67a3f5c99783361ff22e4e Mon Sep 17 00:00:00 2001 From: adobie Date: Thu, 16 Apr 2020 10:47:44 +0100 Subject: [PATCH 2/2] Added accomodation for federated login detection --- UhOh365.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/UhOh365.py b/UhOh365.py index 3f7c3a6..3771ede 100755 --- a/UhOh365.py +++ b/UhOh365.py @@ -60,8 +60,12 @@ def thread_worker(args): r = requests.get('https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/{}@{}?Protocol=Autodiscoverv1'.format(junk_user, domain), headers=headers, verify=args.nossl, allow_redirects=False, proxies=proxies) if r.status_code == 302 and 'outlook.com/autodiscover' in r.text: domain_is_o365[domain] = True + elif r.status_code == 302 and 'https://outlook.office365.com/autodiscover' in r.text: + domain_is_o365[domain] = True elif r.status_code == 200 and 'https://outlook.office.com/api' in r.text: domain_is_o365[domain] = True + elif r.status_code == 200 and 'https://outlook.office365.com' in r.text: + domain_is_o365[domain] = True else: if args.verbose: print("It doesn't look like '{}' uses o365".format(domain))