Tool 1:Exchangefinder

| | _ _ _ _ | / / | | | | __ _ _ _ __ _ | () __ _____ _____ _ _ | || || | ' / | |/| _ \ |\ \ / | ' / | ' \/ _ / -) |) | (-</ / _ \ V / -) '| |_, |||_|| ||//__|||_,|||_, _|/|//___/_/_|_| |/ |___/

                            Developed and designed by Lazaar Sami
                            lazaars@gmail.com

this is a tool to discover the Lync and MSExchange subdomains from a main domain. It allows to discover the links that are protected by NTLM authentication and therefore probably vulnerable to brute force attack.

Usage: python Exchangefinder.py

Dependencies: requests

we can use patator to perform brute force attack against the NTLM protected urls, Ex:

python patator.py http_fuzz url=https://mail.domain.com/EWS/Services.wsdl user_pass=FILE0:FILE1 0=users.txt 1=pass.txt -t 10 auth_type=ntlm method=get -x ignore:code=401

Tool 2:SSC_extractor.py, An Exchange Autodiscovery Domain User IDs grabber

 _____ _            __      _                  _
/__   \ |__   ___  /__\_  _| |_ _ __ __ _  ___| |_ ___  _ __
  / /\/ '_ \ / _ \/_\ \ \/ / __| '__/ _` |/ __| __/ _ \| '__|
 / /  | | | |  __//__  >  <| |_| | | (_| | (__| || (_) | |
 \/   |_| |_|\___\__/ /_/\_\\__|_|  \__,_|\___|\__\___/|_|


                            Developed and designed by Lazaar Sami
                            inspired by adisenum.rb, http://h.foofus.net/goons/n8/tools/exchange/
                            lazaars@gmail.com

Microsoft Exchange Autodiscover User Account Enumeration Information Disclosure.

This tool extracts domain users ID by using an email address dictionary and exploiting a flaw in the Autodiscovery service of the Exchange server.

Usage:

python SSC_extractor.py

Dependencies: requests, urlparse, urllib2, httplib, prettytable, etaprogress, testchallenge (included in the Repository)

ex: pip install requests

email adresses are collected using https://github.com/laramies/theHarvester Ex:

theHarvester -d domain -b all