Mastering Modern Red Teaming Infrastructure – Part 4

Advanced OSINT, Identity Enumeration & Credential Exposure

---

Introduction

Modern red team engagements rely less on exploits and more on identity abuse and intelligence gathering. Organizations unintentionally expose vast amounts of information through public platforms, cloud identity services, and collaboration tools.

This chapter explains how attackers chain OSINT, identity discovery, and credential testing, while also highlighting where defenders should monitor and intervene. All techniques are presented in a balanced, professional manner for awareness, detection, and security improvement.

---

Why OSINT Is Critical in Modern Attacks

OSINT allows attackers to:

• Avoid malware and exploits

• Operate entirely over legitimate cloud services

• Blend into normal authentication traffic

Identity platforms such as Microsoft Entra ID (Azure AD) expose subtle differences in responses that allow attackers to:

• Validate users

• Discover authentication models

• Identify weak password hygiene

---

Phase 1 – Email Pattern Discovery

Objective

Identify the corporate email format used by the organization.

Common Patterns

• [email protected]

• [email protected]

• [email protected]

Tools & Methods

LinkedIn Manual Enumeration

Search employees and infer patterns from publicly listed emails.

theHarvester

theHarvester -d company.com -b linkedin,bing,google

Hunter.io

Web-based email discovery: https://hunter.io

Phonebook.cz

Search email addresses indexed by certificates: https://phonebook.cz

Output from this phase is a candidate email list.

---

Phase 2 – OSINT User List Expansion

Additional Data Sources

GitHub

Search for leaked commits:

github.com/[email protected]

PDF Metadata

exiftool document.pdf | grep Email

Job Portals & Marketing Pages

• Careers pages

• Press releases

• Public presentations

This phase builds a high-confidence identity dataset.

---

Phase 3 – Email Address Validation

Objective

Confirm which email addresses actually exist.

Validation Techniques

Microsoft Login Error Analysis

Attempt login and observe error messages:

• User not found

• Password incorrect

Microsoft Teams Enumeration

Teams search behavior confirms valid users.

OAuth Endpoint Testing

https://login.microsoftonline.com/common/oauth2/token

Different responses indicate valid vs invalid users.

Impact:

• Reduces noise

• Improves success rate

• Avoids unnecessary authentication attempts

---

Phase 4 – Identity Provider Discovery

Why This Matters

Password spraying behavior differs based on identity provider type.

Managed vs Federated

Discovery Methods

https://login.microsoftonline.com/[email protected]

Response indicates:

• Managed authentication

• Federated authentication (ADFS, Okta, Ping)

This determines next testing strategy.

---

Phase 5 – Credential Testing (Password Spray Awareness)

Concept Overview

Password spraying involves:

• Testing one password across many users

• Spreading attempts over time

• Avoiding account lockouts

This technique targets:

• Weak passwords

• Password reuse

• Poor monitoring

---

Tools Used (Awareness Context)

Go365 (Azure AD spraying)

go365 -domain company.com -userlist users.txt -passwords passwords.txt

Burp Suite (Manual testing)

• Intruder module

• Low-rate attack configuration

Custom Python Scripts

Using MS login endpoints with timing delays.

Some darkweb leaked credentials sites I’m using, and I found it useful

http://darkleakyqmv62eweqwy4dnhaijg4m4dkburo73pzuqfdumcntqdokyd.onion/ http://7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion/ http://hackeoyrzjy3ob4cdr2q56bgp7cpatruphcxvgbfsiw6zeqcc36e4ryd.onion/ http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/ http://5odv4qjwkhpv3obbtqlgjsk3xfcr6llfvu6dfn6u4e5umhjd3flikgid.onion/ http://ux7z5awxtjr45bxtbuegyrwprndt5jigchlothsjparbj5jypz56wcid.onion/ http://craf75ymkprmhrb5j42n2oluyteejneibffuz6zgfr3mzw4obk2f3oyd.onion/ http://rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion/

---

Phase 6 – OPSEC & Evasion Techniques

Common OPSEC Measures

Cloud-Origin Traffic

Use cloud IPs to blend in:

• AWS

• Azure

• GCP

IP Rotation

• API Gateway

• Proxy pools

Browser Imitation

• Realistic User-Agent strings

• Correct TLS fingerprints

These measures reduce anomaly-based detection.

---

Phase 7 – Detection Challenges for Defenders

Why these attacks are missed:

• No malware involved

• Uses legitimate authentication endpoints

• Low-rate distributed attempts

Common blind spots:

• No monitoring of external sign-in logs

• Over-reliance on lockout thresholds

• Limited behavioral analytics

---

Defensive Detection Recommendations

Logs to Monitor

• Microsoft Entra ID Sign-in Logs

• Conditional Access Logs

• Identity Protection Alerts

Detection Ideas

• Same password used across many users

• Authentication attempts from cloud providers

• Time-distributed failures

• Enumeration-style error responses

---

Mitigation Strategies

Identity Hardening

• Enforce strong password policies

• Disable legacy authentication

• Use phishing-resistant MFA (FIDO2)

Exposure Reduction

• Minimize public email exposure

• Limit employee metadata online

• Monitor OSINT leakage

Monitoring Improvements

• Implement behavioral detections

• Alert on spray-like patterns

• Correlate sign-ins across time windows

---

Key Takeaways

• OSINT enables attacks without touching internal assets

• Identity platforms are primary targets

• Credential attacks are stealthy and persistent

• Detection requires behavioral, not signature-based controls

Understanding these techniques strengthens both red team realism and blue team readiness.

---

Disclaimer

This content is provided strictly for educational and defensive security awareness purposes.

---