View Source RealmOsintEx (RealmOsintEx v0.2.0)
RealmOsintEx is an OSINT tool built with Elixir for querying Microsoft's GetUserRealm endpoint using Req.
This library uses a fixed username prefix ("username@"
) so that callers only need to supply a domain (e.g., "example.com"
).
The full login is then constructed as "username@example.com"
.
The JSON response from the endpoint varies based on the domain’s configuration.
For a Federated Domain, the response may include:
"State"
: integer status (e.g., 3, meaning federated)."UserState"
: integer providing additional context."Login"
: full user login (e.g.,"username@example.com"
)."NameSpaceType"
: typically"Federated"
."DomainName"
: the domain (e.g.,"example.com"
)."FederationGlobalVersion"
: integer version (often-1
)."AuthURL"
: URL to redirect for federated authentication."FederationBrandName"
: the identity provider's brand."AuthNForwardType"
: an integer indicating the authentication forwarding type."CloudInstanceName"
: usually"microsoftonline.com"
."CloudInstanceIssuerUri"
: the issuer URI for the cloud instance.
For an Unknown Domain, the response may only include:
"State"
: an integer (e.g., 4, meaning non-federated)."UserState"
: integer providing additional context."Login"
: the constructed login."NameSpaceType"
: typically"Unknown"
.
This tool empowers OSINT investigations by quickly identifying a domain's authentication configuration.
Summary
Functions
Retrieves user realm information for a given domain using Req.
Functions
Retrieves user realm information for a given domain using Req.
A fixed username prefix of "username@"
is used to build the login,
so you only need to pass the domain (e.g., "example.com"
).
Parameters
- domain: A string representing the domain (e.g.,
"example.com"
).
Returns
{:ok, map}
with keys such as:"State"
: integer"UserState"
: integer"Login"
: string (e.g.,"username@example.com"
)"NameSpaceType"
: string"DomainName"
: string (if provided)"FederationGlobalVersion"
: integer (if provided)"AuthURL"
: string (if provided)"FederationBrandName"
: string (if provided)"AuthNForwardType"
: integer (if provided)"CloudInstanceName"
: string (if provided)"CloudInstanceIssuerUri"
: string (if provided)
{:error, reason}
if the HTTP request or JSON processing fails.