New Exploits Target Azure AD and Web Applications

Two new cybersecurity tools have been released: the CRT exploit for querying Azure AD configurations and the Sandcat exploit, a lightweight web browser for penetration testing. The CRT exploit helps organizations secure their Azure AD environments by identifying misconfigurations and permissions that could be exploited. It queries various settings, including federation configurations and mailbox access permissions. The Sandcat exploit combines Chromium's speed with Lua scripting for web application testing, offering features like live headers and a command-line interface. Both tools are aimed at security professionals and developers, enhancing their capabilities to identify vulnerabilities in cloud and web environments. The CRT exploit requires administrative access to Microsoft 365, while Sandcat focuses on web application testing. Both tools are available for download and use in security assessments.

Key Points: • CRT exploit aids in securing Azure AD configurations. • Sandcat is a lightweight browser for web application testing. • Both tools enhance security professionals' capabilities.