Recon Tool: msprobe

Reading Time: 2 Minutes

msprobe

This tool by puzzlepeaches, lets you find all things on-prem Microsoft for password spraying and enumeration. It will use a list of common subdomains associated with your target apex domain to attempt and discover valid instances of on-prem Microsoft solutions. You can find ADFS servers, RD Web servers, and more. Great for recon and getting ready before spraying attacks as part of your Red Team Assessment.

Screenshots of the tool in action are below:

Installing

Install the project using pipx

pipx install git+https://github.com/puzzlepeaches/msprobe.git

Usage

The tool has four different modules that assist with the discovery of on-prem Microsoft products:

• Exchange
• RD Web
• ADFS
• Skype for Business

The help menu and supported modules are shown below:

Examples

Find ADFS servers associated with apex domain:

msprobe adfs acme.com

Find RD Web servers associated with apex domain with verbose output:

msprobe rdp acme.com -v

Find all Microsoft products hostsed on-prem for a domain:

msprobe full acme.com

Clone the repo from here: GitHub Link