search

blacklanternsecurity / TREVORspray

TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!
GNU General Public License v3.0
1.04k stars 147 forks source link

False positives maybe? #23

Closed JitBox closed 1 year ago

JitBox commented 1 year ago

When I do the following query, I see some SUCCESS messages when I know they are bogus. Here is my command I am running:

trevorspray -u emails.txt --passwords "test" --url https://login.microsoft.com/

I am trying to see which on my list of emails is an actual valid account and which is not through that URL. When I run it, I am seeing [SUCC] asdvsdnvasdv@svaoskrva.com:test

is this normal? Please guide me if I am doing something wrong.

TheTechromancer commented 1 year ago

The URL needs to be a valid OAUTH endpoint. It's normally autodetected, you shouldn't need to specify it except in special situations.