MailSniper

MailSniper also includes additional modules for password spraying, enumerating users/domains, gathering the Global Address List from OWA and EWS, and checking mailbox permissions for every Exchange user at an organization. A full list of options that can be used are: ExchHostname – The hostname of the Exchange server to connect to if Autodiscover is failing. Mailbox – Email address of the current user the PowerShell process is running as (i.e. the only mailbox the account can search). Terms – Certain terms to search through each email subject and body for. By default the script looks for “*password*”,”*creds*”,”*credentials*”. ExchangeVersion – In order to communicate with Exchange Web Services the correct version of Microsoft Exchange Server must be specified. By default this script tries “Exchange2010”. Additional options to try are Exchange2007_SP1, Exchange2010, Exchange2010_SP1, Exchange2010_SP2, Exchange2013, or Exchange2013_SP1. OutputCsv – Outputs the results of the search to a CSV file. MailsPerUser – The total number of latest emails to search through in the mailbox. The default is set to the latest 100 emails in the inbox.