Downloading an Address Book from an Outlook Web App (OWA) Portal

This blog post demonstrates a reconnaissance technique using Burp Suite Pro to extract email addresses from an Outlook Web App (OWA) address book by proxying web traffic and scrolling to force all entries to load, enabling an attacker or pentester to build large username lists for password-spraying; the author also notes configuration tips (live passive scanning) and that the technique may be outdated.