Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/shkudw/entraenum
EntraEnum is PowerShell based tool designed for enumerating and interacting with Azure Active Directory (Entra ID) environments. With support for device code phishing, token management, and enumeration features.
https://github.com/shkudw/entraenum
azure entra-id penetration-testing powershell-script redteam
Last synced: 3 months ago
JSON representation
EntraEnum is PowerShell based tool designed for enumerating and interacting with Azure Active Directory (Entra ID) environments. With support for device code phishing, token management, and enumeration features.
- Host: GitHub
- URL: https://github.com/shkudw/entraenum
- Owner: ShkudW
- Created: 2024-10-21T22:44:18.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2024-10-22T13:16:39.000Z (3 months ago)
- Last Synced: 2024-10-22T19:06:15.440Z (3 months ago)
- Topics: azure, entra-id, penetration-testing, powershell-script, redteam
- Language: PowerShell
- Homepage:
- Size: 51.8 KB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# EntraEnum
```powershell
_____ _ _____
| ____|_ __ | |_ _ __ __ _| ____|_ __ _ _ _ __ ___
| _| | '_ \| __| '__/ _` | _| | '_ \| | | | '_ ` _ \
| |___| | | | |_| | | (_| | |___| | | | |_| | | | | | |
|_____|_| |_|\__|_| \__,_|_____|_| |_|\__,_|_| |_| |_|
=======================================================
```
**EntraEnum** is a PowerShell-based tool designed for enumerating various resources in Azure Active Directory (Entra ID) environments. It allows penetration testers and system administrators to interact with Azure AD APIs, retrieve details about users, groups, applications, and more, while also supporting advanced features like device code phishing and token refresh.
## Features
- **Enumerate Azure AD Resources:**
- Users, Groups, Applications, Service Principals, Devices, Roles, Sign-ins, Subscriptions, and Contacts.
- **Device Code Phishing:**
- Generate device codes to phish access tokens from users.
- **Token Management:**
- Obtain new access and refresh tokens using a refresh token.
## Usage
```powershell
# Retrieve Tenant ID
Invoke-EntraEnum -domain
```
```powershell
# Enumerating Users, Groups, Applications, etc..
Invoke-EntraEnum -AccessToken -users
Invoke-EntraEnum -AccessToken -groups
Invoke-EntraEnum -AccessToken -applications
Invoke-EntraEnum -AccessToken -devices
Invoke-EntraEnum -AccessToken -roles
Invoke-EntraEnum -AccessToken -signins
Invoke-EntraEnum -AccessToken -subscriptions
Invoke-EntraEnum -AccessToken -contacts
```
```powershell
# Generate a device code for phishing
Invoke-EntraEnum -devicecodephishing
```
```powershell
# Retrieve access and refresh tokens after the user inputs the device code
Invoke-EntraEnum -DeviceCodeResults
```
```powershell
# Use a refresh token to obtain new access and refresh tokens
Invoke-EntraEnum -domain -RefreshToken
```
## Nice to know:
If you see this error: 'API call failed: The remote server returned an error'.
It means you sent too many requests, Wait 30 seconds and resend the request.
## PoC
