View Source RealmOsintEx (RealmOsintEx v0.2.0)

RealmOsintEx is an OSINT tool built with Elixir for querying Microsoft's GetUserRealm endpoint using Req.

This library uses a fixed username prefix ("username@") so that callers only need to supply a domain (e.g., "example.com"). The full login is then constructed as "username@example.com".

The JSON response from the endpoint varies based on the domain’s configuration.

For a Federated Domain, the response may include:

  • "State": integer status (e.g., 3, meaning federated).
  • "UserState": integer providing additional context.
  • "Login": full user login (e.g., "username@example.com").
  • "NameSpaceType": typically "Federated".
  • "DomainName": the domain (e.g., "example.com").
  • "FederationGlobalVersion": integer version (often -1).
  • "AuthURL": URL to redirect for federated authentication.
  • "FederationBrandName": the identity provider's brand.
  • "AuthNForwardType": an integer indicating the authentication forwarding type.
  • "CloudInstanceName": usually "microsoftonline.com".
  • "CloudInstanceIssuerUri": the issuer URI for the cloud instance.

For an Unknown Domain, the response may only include:

  • "State": an integer (e.g., 4, meaning non-federated).
  • "UserState": integer providing additional context.
  • "Login": the constructed login.
  • "NameSpaceType": typically "Unknown".

This tool empowers OSINT investigations by quickly identifying a domain's authentication configuration.

Summary

Functions

get_realm(domain, format \\ :xml)

Retrieves user realm information for a given domain using Req.

parse_xml(xml_string)

Functions

get_realm(domain, format \\ :xml)

Retrieves user realm information for a given domain using Req.

A fixed username prefix of "username@" is used to build the login, so you only need to pass the domain (e.g., "example.com").

Parameters

  • domain: A string representing the domain (e.g., "example.com").

Returns

  • {:ok, map} with keys such as:

    • "State": integer
    • "UserState": integer
    • "Login": string (e.g., "username@example.com")
    • "NameSpaceType": string
    • "DomainName": string (if provided)
    • "FederationGlobalVersion": integer (if provided)
    • "AuthURL": string (if provided)
    • "FederationBrandName": string (if provided)
    • "AuthNForwardType": integer (if provided)
    • "CloudInstanceName": string (if provided)
    • "CloudInstanceIssuerUri": string (if provided)

  • {:error, reason} if the HTTP request or JSON processing fails.

parse_xml(xml_string)