Using PowerShell to Identify Federated Domains

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.

Teaches enumerating the 1,500-plus WMI classes on a system with Get-CimClass, then dissecting properties and methods of classes like Win32_Process to find attacker-useful functionality.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

Examines security issues in federated Skype for Business, showing how external domains can validate email addresses, read availability and out-of-office status, and deliver phishing messages.

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

AD DS vs Azure AD: Kerberos and LDAP at the enterprise datacenter versus SAML, OAuth and OpenID in the cloud—why federated protocols rather than Kerberos fit cloud authentication.