Comments (8)
Hey Brian! Thanks for the note. I have heard some mixed results with that module. I modified it so it should just get the domain from a response header. If you just run Invoke-DomainHarvestOWA -ExchHostname mail.whatever.com it will try that method first. Let me know if that part isn't working for the server you are hitting as well. Do you happen to know what version of Exchange the server is running?
-Beau
from mailsniper.
Hey there,
Ok so I found out it's an Exchange 2010 box (no specific version info known, but I can get that if it would be helpful).
I had been running Invoke-DomainHarvestOWA -ExchHostname customers.owa.portal.com -DomainList domains.txt -OutFile out.file
. The domains.txt
has about 5 bogus domain names but also the correct domain name, but MailSniper reports 0 valid domains.
Per your note above, it sounds like you wanted me to run just Invoke-DomainHarvest OWA -ExchHostname customers.owa.portal.com
which I did, but it asks for either a DomainList or CompanyName to complete. I tried providing one - as well as both - but the end result was the same.
Brian
from mailsniper.
Oh sorry, maybe you were saying you made changes and that I should pull latest version? I was just going to send you a ping that the tool says ...provide either a DomainList or a *ComapnyName*...
but that spelling has been fixed to CompanyName, so I'm thinking I don't have the latest version. Let me know what info I can provide.
from mailsniper.
Yeah it's been updated to have different functionality. Go grab the latest and try with just "Invoke-DomainHarvestOWA -ExchHostname customers.owa.portal.com". It should try to automatically grab the domain from an http header returned from the server.
from mailsniper.
Hiya Beau,
Happy Friday. Pardon the delay, but I did try running the latest MailSniper and what got returned was:
The domain appears to be: *INTERNAL-SERVERNAME.somedomain.local
I then tried:
Invoke-UsernameHarvestOWA -ExchHostname owa.customer.com -UserList .\users.txt - Domain somedomain.local
Also tried the same thing but with Domain somedomain
Still, even with legit users in my users.txt
MailSniper didn't say I had a winner.
I'm actually done with this current project but could certainly test other things if you want. And I've got some new assessments coming in the next week and will try MailSniper there as well.
Thanks!
Brian
from mailsniper.
Piggybacking on this issue. I seem to be experiencing the same response time issue in my test lab. All usernames regardless if they are "real" or not are receiving the same response time back from OWA.
- Usernames are combination of known valid and made up
- Domain is known valid
- Tested in both VMware and VirtualBox environments
Response Times for Case 1
Baseline Response: 207.6
Average Time: 207.6
Threshold: 124.56
Typical response for this case was between 202 to 219 ms
Response Times for Case 2
Baseline Response: 5
Average Time: 5
Threshold: 3
Typical response for this case was between 5-21 ms
Using command
Invoke-UsernameHarvestOWA -ExchHostname mail.domain.com -Domain THEDOMAIN -UserList .\userlist.txt -OutFile test.txt -verbose -debug
Using -debug and -verbose I was able to see the following output
VERBOSE: POST https://mail.domain.com/owa/auth.owa with -1-byte payload
VERBOSE: received 0-byte response of content type
from mailsniper.
For anyone still experiencing this, try this method instead: https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/
It may be more reliable
from mailsniper.
Thanks @Boberttt !
from mailsniper.
Related Issues (20)
- Key word synonym's
- The underlying connection was closed: An unexpected error occurred on a send. HOT 1
- Feature Request - Proxy support HOT 1
- Feature Request - Ignore SSL errors HOT 3
- Feature Request : Check userlist with specific password for each
- Exception calling Bind: ID property must be set
- Trouble with module?
- Problems running Invoke-SelfSearch and Invoke-GlobalMailSearch HOT 2
- Exception calling ".ctor" with "2" argument(s): "Cannot process argument because the value of argument "userName" is not valid HOT 1
- Exception: The Autodiscover service couldn't be located.
- Latest version: "reserved for future use" and other errors HOT 1
- HTTP 400 with Invoke-InjectGEventAPI
- i need to testing the Invoke-PasswordSprayEWS
- Impersonation Account Credential HOT 2
- Credentials HOT 2
- Invoke-PasswordSprayEWS threads
- The request failed. The remote server returned an error : Forbidden HOT 3
- The Gmail spray module HOT 2
- Typo: Invoke-GlobalO365MailSearch -UsePrtImperonsationAccount HOT 2
- Feature Request - Rate Limiter
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from mailsniper.