MFASweep: checking if MFA is enabled on multiple Microsoft Services
MFASweep
MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled. Depending on how conditional access policies and other multi-factor authentication settings are configured some protocols may end up being left single factor. It also has an additional check for ADFS configurations and can attempt to log in to the on-prem ADFS server if detected.
Currently, MFASweep can login to the following services:
- Microsoft Graph API
- Azure Service Management API
- Microsoft 365 Exchange Web Services
- Microsoft 365 Web Portal w/ 6 device types (Windows, Linux, MacOS, Android Phone, iPhone, Windows Phone)
- Microsoft 365 Active Sync
- ADFS
WARNING: This script attempts to login to the provided account TEN (10) different times (11 if you include ADFS). If you entered an incorrect password this may lock the account out.
For more information check out the blog post here: Exploiting MFA Inconsistencies on Microsoft Services
Download
git clone https://github.com/dafthack/MFASweep.git
Usage
This command will use the provided credentials and attempt to authenticate to the Microsoft Graph API, Azure Resource Manager API, Microsoft 365 Exchange Web Services, Microsoft 365 Web Portal with 7 different user agents, and Microsoft 365 Active Sync. If any authentication methods result in success, tokens and/or cookies will be written to AccessTokens.json. (Currently does not log cookies or tokens for EWS, ActiveSync, and ADFS.)
[pastacode lang=”markup” manual=”Invoke-MFASweep%20-Username%20targetuser%40targetdomain.com%20-Password%20Winter2026%20-WriteTokens” message=”” highlight=”” provider=”manual”/]
This command runs with the default auth methods and checks for ADFS as well.
[pastacode lang=”markup” manual=”Invoke-MFASweep%20-Username%20targetuser%40targetdomain.com%20-Password%20Winter2026%20-Recon%20-IncludeADFS” message=”” highlight=”” provider=”manual”/]
Individual Modules
Each individual module can be run separately if needed as well.
Microsoft Graph API
Invoke-GraphAPIAuth –Username targetuser@targetdomain.com –Password Winter2020
Azure Service Management API
Invoke-AzureManagementAPIAuth –Username targetuser@targetdomain.com –Password Winter2020
Microsoft 365 Exchange Web Services
Invoke-EWSAuth –Username targetuser@targetdomain.com –Password Winter2020
Microsoft 365 Web Portal
Invoke-O365WebPortalAuth –Username targetuser@targetdomain.com –Password Winter2020
Microsoft 365 Web Portal w/ Mobile User Agent
Invoke-O365WebPortalAuthMobile –Username targetuser@targetdomain.com –Password Winter2020
Microsoft 365 Active Sync
Invoke-O365ActiveSyncAuth –Username targetuser@targetdomain.com –Password Winter2020
ADFS
Invoke-ADFSAuth –Username targetuser@targetdomain.com –Password Winter2020
Copyright (c) 2020 dafthack
Source: https://github.com/dafthack/
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
