Skip to content

Conversation

@stfnw
Copy link

@stfnw stfnw commented Nov 1, 2025

Include domain and username in the default/catch-all error message, so that this information is not lost.

Verification

  • Start msfconsole
  • use auxiliary/scanner/http/azure_ad_login
  • set appropriate options (user/pass/domain)
  • Verify the thing does what it should: it prints an error message with context showing the corresponding username.
  • Verify the thing does not do what it should not: it doesn't omit the username information from the message.
  • Document the thing and how it works (Example): This is not necessary for a change this small.

Include domain and username in the default/catch-all error message,
so that this information is not lost.
@stfnw
Copy link
Author

stfnw commented Nov 1, 2025

Motivation behind this is to be able to map the error message back to the affected user.
More specifically, I had the case were I got AADSTS81016: Invalid STS request. as an error message (also see https://github.com/nyxgeek/AzureAD_Autologon_Brute/blob/main/README.md#update---20240221 which mentions that return code).

All in all, this change turns the following error message:

Received unknown response with error code: AADSTS81016: Invalid STS request.

Into this one:

Received unknown response for <domain>\<user>:<password> with error code: AADSTS81016: Invalid STS request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant