Attacking Exchange with MailSniper

This report outlines three MailSniper PowerShell modules—Get-GlobalAddressList, Invoke-PasswordSprayOWA, and Invoke-PasswordSprayEWS—that enable automated collection of an organization’s Global Address List from Exchange (using OWA FindPeople on Exchange 2013 or an EWS fallback) and large-scale password-spray attacks against OWA/EWS; it includes example commands, PowerShell version requirements, and performance observations (EWS spraying is significantly faster).