No Longer Possible to Leak Tenant Domains

[m0chan]

It is no longer possible to leak tenant domains using trevorspray, it looks like microsoft maybe changed the behaviour to prevent other tenant domains from being leaked?

[TheTechromancer]

RIP this was fun while it lasted. If anybody finds a bypass please share!

[P1P3rx]

any updates?

[TheTechromancer]

Update: We found a manual way to generate this data, and we'll be spinning up an API soon. Stay tuned!

FYSA @aconite33

[zcrosman]

How does the manual method work?

[TheTechromancer]

If you start with a domain, you can ask Microsoft for its openid config to get the tenant id. So you have to know which domains to try. But it at least lets you confirm whether they belong to the same tenant.