Any offensive security operator will tell you that guessing employee credentials is key to compromising your customer’s network – and subsequently highlighting vulnerabilities during penetration testing engagements. The thing is, it’s easier said than done as companies increasingly continue to transition to cloud services such as Microsoft Office 365 (O365) – all of which provide multi-factor authentication (MFA) and other auxiliary security controls.
It used to be easy to compromise a user’s account while targeting Microsoft Exchange. All an operator had to do was discover a client’s Exchange server, enumerate usernames, and password spray until their heart was content. This isn’t nearly as easy as it used to be, however. Password spraying and MFA bypasses in the modern security landscape
so.cl
Rascals are always sociable, and the chief sign that a man has any nobility in his character is the little pleasure he takes in others company. Arthur Schopenhauer