Archives

Ein Pentest auf Microsoft 365 durchzuführen ist theoretisch und praktisch möglich. Es gibt einige Verbände, wie den GDV, die einen Pentest für ihre Mitglieder:innen durchgeführt haben und die Kosten, sowie die Ergebnisse geteilt hat. Dies ist sinnvoll, da man dies sehr gut zentralisieren kann, da der Pentest auf ein SaaS System kaum zu großartigen Unterschieden führen sollte.

Ihr solltet bevor Ihr mit einem Pentest startet den Microsoft Support informieren.

In der Regel gehört hierzu auch ein optinaler Zusatzvertrag, den ihr mit Microsoft schließen könnt, um eigene Pentest durchführen zu können. Diesen gibt es zum Beispiel speziell für Banken und Versicherungen, die unter BaFin Kontrolle mit BAIT und VAIT stehen.

Weiterhin hat Microsoft mit dem Attack Manager im Security Center auch eine Möglichkeit geschaffen (E5) Pentests aus der Umgebung heraus durchzuführen.

Ich selber habe schon mehrfach Pentests auf Office 365 Umgebunden durchgeführt und auch begleitet. Im Folgenden findet ihr meine Linksammlung zum Thema:

Allgemeine Links

https://www.microsoft.com/pt-br/microsoft-365/microsoft-365-for-existing-subscribers

 

Links rund um Pentesting in Office 365

https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement

Pentesting Microsoft Office 365

https://bond o.medium.com/microsoft-office-365-enumeration-58f9b5ba21c8

https://www.mdsec.co.uk/2019/07/introducing-the-office 365-attack-toolkit/

https://thecyphere.com/blog/office365-security-best-practices/

https://www.lmgsecurity.com/will-you-be-pwned-in-an-office-365-brute-force-attack-use-this-free-tool-for-testing/

https://intercom.help/cobalt/en/articles/4641747-network-office-365-penetration-testing

Owning O365 Through Better Brute-Forcing

https://www.redscan.com/news/office 365 security six ways to safeguard your
environment against cyber attacks/

https://www.kitploit.com/2019/07/o365 attack toolkit toolkit to attack.html?m=0

https://vapt.ee/offensive security/penetration testing/cloud penetration testing/office365
penetration testing/

https://www.blackhillsinfosec.com/tag/office365/

https://github.com/0xZDH/o365spray

https://github.com/S3cur3Th1sSh1t/Pentest Tools

https://github.com/mdsecresearch/LyncSniper

https://github.com/byt3bl33d3r/SprayingToolkit

https://github.com/sensepost/ruler

https://pentestbook.six2dez.com/enumeration/cloud/azure

https://www.blackhatethicalhacking.com/tools/o365 attack toolkit/

https://www.cryptron.ch/security analysis microsoft office 365 advanced threat protection/

raindance: Reconnaissance tool for Microsoft Office 365

https://www.microsoft.com/pt br/msrc/pentest rules of engagement

https://www.agileit.com/news/pentesting microsoft office 365/

https://www.mdsec.co.uk/2019/07/introducing the office 365 attack toolkit/

https://thecyphere.com/blog/office365 security best practices/

https://www.linkedin.com/pulse/risk assessment penetration testing microsoft azure satinder/

https://www.cryptron.ch/security analysis microsoft office 365 advanced threat protection/

https://i.blackhat.com/USA 20/Thursday/us 20 Bienstock My Cloud Is APTs Cloud Investigating And DefendingOffice 365.pdf

https://i.blackhat.com/USA 19/Wednesday/us 19 Metcalf Attacking And Defending The Microsoft Cloud.pdf

https://www.blackhat.com/docs/us 17/wednesday/us 17 Dods Infecting The Enterprise Abusing Office365Powershell For Covert C2.pdf

https://github.com/Kyuu Ji/Awesome-Azure-Pentest

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20%20Azure%20Pentest.md

https://book.hacktricks.xyz/cloud security/cloud security review

Exploiting MFA Inconsistencies on Microsoft Services

https://www.optiv.com/insights/source-zero/blog/go365-office-365-password-spraying-tool

https://github.com/duocircle/Office365 Phishing Rules

https://github.com/AlteredSecurity/365 Stealer

https://github.com/mdsecactivebreach/o365 attack toolkit

https://docs.microsoft.com/en us/microsoft 365/admin/security and compliance/set up multi factor
authentication?redirectSourcePath=%252fen us%252farticle%252fSet up multi factor authentication for
Office 365 users 8f0454b2 f51a 4d9c bcde 2c48e41621c6&view=o365 worldwide#enablemfaoffice365

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft 365/security/office 365
security/set up anti phishing policies.md

https://github.com/pentestgeek/phishing frenzy templates/tree/master/office365

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft 365/campaigns/m365
campaigns phishing and attacks.md

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft 365/security/office 365
security/tuning anti phishing.md

https://github.com/milo2012/phishing scripts/blob/master/o365.py

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft 365/security/office 365
security/recommended settings for eop and office365.md

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft
365/security/office 365 security/attack simulation training.md

https://techcommunity.microsoft.com/t5/security compliance and identity/attack simulator
need a real phishing template library to be/m p/1405895

https://staaldraad.github.io/2017/08/02/o356 phishing with oauth/

https://medium.com/sekoia io blog/analysis and detection of mitm phishing attacks bypassing
2fa o365 use case cf0ffdae9cae

https://hooksecurity.co/phishing examples/github phishing example

https://otx.alienvault.io/pulse/5df9f836cfe26eacac1703ad

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft
365/security/office 365 security/attack simulator.md

https://github.com/MicrosoftLearning/MS 500 Microsoft 365
Security/blob/master/Instructions/Labs/MS500T00/LAB_AK_06_Lab1_Ex1_Phishing_attack.md

https://github.com/MicrosoftLearning/MS 101T00 Microsoft 365 Mobility and
Security/blob/master/Instructions/Labs/LAB_AK_03_Lab3_Ex1_AttackSim_Phishing_attack.md

Pentest auf Azure – Werkzeuge

https://github.com/dirkjanm/ROADtools

https://github.com/dafthack/PowerMeta

https://github.com/NetSPI/MicroBurst

https://github.com/nccgroup/ScoutSuite

https://github.com/hausec/PowerZure

https://github.com/fox-it/adconnectdump

https://github.com/FSecureLABS/Azurite

https://github.com/mburrough/pentestingazureapps

https://github.com/Azure/Stormspotter

https://github.com/nccgroup/azucar

https://github.com/dafthack/MSOLSpray

https://github.com/BloodHoundAD/BloodHound

https://github.com/nccgroup/Carnivore

https://github.com/CrowdStrike/CRT

https://github.com/Kyuu-Ji/Awesome-Azure-Pentest

https://github.com/cyberark/blobhunter18https://github.com/Gerenios/AADInternals

Angriffe auf Office 365 

Passwort Spray Attacke: https://github.com/0xZDH/o365spray

MailSniper: https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/

Ablauf-Beispiel

Quelle: https://vapt.ee/offensive-security/penetration-testing/cloud-penetration-testing/office365-penetration-testing/

Links rund um Phising und Härtung von Office 365

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft 365/security/office 365 security/defender for office 3 65.md

https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Delivery/Open%20email%20link.txt

https://github.com/MicrosoftDocs/microsoft 365 docs/blob/public/microsoft 365/security/office 365 security/security recommendati ons forpriority accounts.md

https://docs.microsoft.com/pt br/microsoft 365/security/defender/overview security center?view=o365
worldwide#:~:text=O%20Microsoft%20365%20de%20seguran%C3%A7a,seguran%C3%A7a%20para%20o%20portal%20unificado.&text=As%20fun%C3%A7%C3%B5es%20j%C3%A1%20nos%20produtos,portal%20Microsoft%20365%20seguran%C3%A7a%2C%20automaticamente.

https://www.microsoft.com/security/blog/office 365 security/

https://www.cloudfastpath.com/office 365 migration/top office 365 security features examples/

https://docs.microsoft.com/pt br/microsoft 365/security/office 365 security/security dashboard?view=o365 worldwide

https://www.youtube.com/watch?v=hI4Kid uzxY

https://techcommunity.microsoft.com/t5/security compliance and identity/announcing-microsoft-365-security-for-it-pros-2021-edition/m-p/1518661

https://medium.com/falconforce/reducing your office365 attack surface 1073a4d46a7b

https://www.beazley.com/documents/TMB/Insights/beazley bbr hardening_O365_best_practices_08312018.pdf

https://www.cisecurity.org/benchmark/microsoft_office/

https://static1.squarespace.com/static/5bbb4a7301232c6e6c8757fa/t/603f6ea2dbc4a57691453b61/1614769826578/Office+365+Hardening .pd f

 

Allgemeine Pentesting Tools

• General usefull Powershell Scripts
• AMSI Bypass restriction Bypass
• Payload Hosting
• Network Share Scanner
• Lateral Movement
• Reverse Shellz
• POST Exploitation
• Pivot
• Backdoor finder
• Persistence on windows
• Web Application Pentest
• Framework Discovery
• Framework Scanner / Exploitation
• Web Vulnerability Scanner / Burp Plugins
• Network- / Service-level Vulnerability Scanner
• Crawler
• Web Exploitation Tools
• Windows Privilege Escalation / Audit
• T3 Enumeration
• Linux Privilege Escalation / Audit
• Credential harvesting Windows Specific
• Credential harvesting Linux Specific
• Data Exfiltration – DNS/ICMP/Wifi Exfiltration
• Git Specific
• Reverse Engineering / decompiler
• Forensics
• Network Attacks
• Specific MITM service Exploitation
• Sniffing / Evaluation / Filtering
• Scanner / Exploitation-Frameworks / Automation
• Default Credential Scanner
• Payload Generation / AV-Evasion / Malware Creation
• Domain Finding / Subdomain Enumeration
• Scanner network level
• Email Gathering
• Domain Auth + Exploitation
• Network service – Login Brute Force + Wordlist attacks
• Command & Control Frameworks
• Wifi Tools
• Raspberri PI Exploitation
• Social Engeneering
• Wordlists / Wordlist generators
• Obfuscation
• Source Code Analysis
• No category yet
• Industrial Control Systems
• NAC bypass
• JMX Exploitation