UhOh365 is a Python script designed to determine the validity of email addresses within the Microsoft Office365 domain. It achieves this by utilizing the Autodiscover API, a feature intended for email configuration, to check for the existence of an email address without requiring any authentication or login attempts. This approach distinguishes it from other validation tools that often rely on brute-forcing or login-based verification methods.
This project's key strength lies in its ability to perform email enumeration without triggering security alerts or being detected by the target system. It leverages the unthrottled nature of the Autodiscover API, allowing for rapid validation of a large number of email addresses. The script is straightforward to use and requires minimal configuration, making it accessible to a wide range of users.
- Zero Login Attempts: Validates email addresses without requiring any credentials or authentication.
- Unthrottled API: Allows for rapid validation of numerous email addresses without rate limiting issues.
- Simple Configuration: Requires minimal setup, primarily an input file containing email addresses.
- Output Options: Supports outputting valid emails to a specified file.
- Verbose Mode: Provides detailed output for each email validation result.
- Suffix Addition: Enables automatic appending of a domain suffix to input email addresses.
- SSL Control: Offers an option to disable SSL verification for potentially faster execution.
The project appears to be a relatively complete and functional script, with clear documentation and a straightforward usage pattern. The last commit in March 2021 suggests the project received some maintenance at the time. However, the lack of recent commits indicates that active development or updates may have ceased. The simple nature of the code and the well-defined API it utilizes suggests a stable and reliable tool.
UhOh365 benefits security professionals and penetration testers by providing a powerful tool for email enumeration within the Office365 environment. It enables efficient discovery of valid email addresses for social engineering assessments and vulnerability analysis, offering an alternative to methods that might be easily detected or blocked. It streamlines the process of identifying active email accounts, saving time and effort compared to manual verification or less sophisticated approaches.