EBurst is a Python tool that consolidates password-audit capability against nine Microsoft Exchange endpoints into a single script, intended for authorized assessments of mail infrastructure you own or are contracted to test.

EBurst from grayddq is a compact Python utility whose entire reason for existing is consolidation. The author states plainly in the README that existing public tooling did not fit their needs, so they wrote a semi-automated script that gathers the mainstream brute-force vectors against Microsoft Exchange into one place. The repository sits at roughly 343 stars, is written in Python, and ships as a single entry point, EBurst.py, alongside a lib directory, a requirements.txt, and documentation. Version numbering is minimal — the README titles itself EBurst 0.1 — which signals an early-stage but functional tool rather than a polished framework.

The core value proposition is breadth of endpoint coverage. Where most Exchange password tools fixate on /owa, the Outlook web front-end, EBurst enumerates nine distinct virtual directories as candidate authentication surfaces: /ecp, /ews, /oab, /owa, /rpc, /api, /mapi, /powershell, and /autodiscover, plus /Microsoft-Server-ActiveSync. Each of these endpoints exposes a different service — the admin center, SOAP web services, offline address book distribution, legacy RPC-over-HTTP, the MAPI protocol used by modern Outlook clients, and mobile mail access respectively — and critically, each may enforce authentication differently and be monitored differently by the blue team.

The most technically interesting feature listed in the README is what the author calls interface authentication-mode recognition with automatic switching. Different Exchange endpoints default to different WWW-Authenticate schemes: the README documents NTLM as the default for autodiscover, ews, mapi, oab, rpc, and api; Basic authentication for activesync; plain HTTP authentication for owa and ecp; and Kerberos for the powershell endpoint, which is explicitly marked as not yet supported in this version. A tool that negotiates the correct challenge-response mechanism per endpoint is meaningfully harder to write than a simple form-buster, and it is where most of the engineering effort evidently went.

The -C / --c flag deserves particular attention because it is the reconnaissance half of the tool. Rather than immediately spraying credentials, EBurst can first verify whether each interface is actually susceptible to brute-force at all — checking whether the endpoint exists, accepts the relevant auth scheme, and returns distinguishable success versus failure responses. In an authorized workflow this is exactly the right first step: you characterize the attack surface, note which virtual directories are exposed, and only then plan password policy validation against the surfaces that matter.

Threading and dictionary support round out the feature list. The README confirms multi-threaded operation with a -T flag defaulting to 100 threads, user lists via -L, password lists via -P, and single-credential modes via -l and -p for targeted verification of a known-good or suspected credential. The -d flag takes the mail domain, and --protocol lets you switch the transport from the default https to http — relevant for lab environments simulating misconfigured internal deployments. The author credits lijiejie's open-source code as the basis for the multithreading framework, a transparency note that tells you the concurrency scaffolding is battle-tested rather than homegrown.

From an architectural standpoint, the layout is conventional and easy to audit: EBurst.py as the CLI driver using what the usage output suggests is optparse, with per-endpoint logic presumably modularized in lib. The interface-type options map one-to-one to Exchange virtual directories (--autodiscover, --ews, --mapi, --activesync, --oab, --rpc, --api, --owa, --powershell, --ecp), which means an assessor can scope a run to a single endpoint family instead of touching all nine — useful for staying within engagement rules of engagement that authorize testing some services but not others.

Installation follows the standard pattern for tools of this vintage: git clone https://github.com/grayddq/EBurst.git, then sudo pip install -r requirements.txt from the repository root. There is no license field in the repository metadata, which is worth noting before embedding it in a commercial engagement toolchain; absent a license, default copyright restrictions apply. The README is written in Chinese, and the usage help text is likewise localized, so non-Chinese-reading operators will want to translate the option descriptions carefully before relying on the tool in a client environment.

It is worth being explicit about what this tool is and is not for. Credential spraying against Exchange is one of the most commonly observed initial-access techniques in real intrusions, precisely because mail endpoints are internet-facing and password policy failures are widespread. In a defensive or authorized context, EBurst functions as a password-policy validator: point it at a lab replica of your Exchange deployment, or at production only with explicit written authorization and coordination with the messaging team, and it will tell you which of your endpoints accept weak or reused credentials. That is a finding worth having before an adversary finds it for you.

Defenders should understand the telemetry this class of activity generates. Every authentication attempt lands in IIS logs against the relevant virtual directory with a source IP, timestamp, and status code; NTLM and Basic failures generate corresponding Windows security events on the Exchange server. A run across nine endpoints from one source address produces a distinctive fan-out pattern — many 401 responses spread across /owa, /ews, /mapi, /ecp and /autodiscover in a short window — which is a high-fidelity detection signal. Correlating across virtual directories rather than per-endpoint is the key, because per-endpoint the volume may sit below naive threshold alerts.

The supporting documentation for each endpoint is a useful reference in itself. The README explains that autodiscover has existed since Exchange Server 2007 to auto-configure Outlook clients, that mapi became the default Outlook connection method from Exchange 2013 with 2010 SP2 support, that oab serves offline address book copies to reduce server load, and that ecp is the administrative web console. Even an operator who never runs the tool gains a compact map of which Exchange surfaces exist, what each is for, and which authentication scheme each nominally speaks — which is half of what attack-surface enumeration against a mail platform is about.

Limitations are visible and honestly stated. The powershell endpoint is marked unsupported, the project carries a 0.1 version tag, and the README notes no rate-limiting, lockout-awareness, or SOCKS/proxy support — all of which matter in a real engagement where tripping Active Directory lockout policies on a client's production directory is a serious operational failure. Any authorized use should assume lockout policy interaction and plan thread counts and password-list sizes accordingly, or better, restrict runs to a lab replica. Modern Exchange Online, of course, sits behind Microsoft's smart lockout and conditional access and is out of scope for a tool aimed at on-premises servers.

In sum, EBurst earns its place as a reminder that Microsoft Exchange is not one authentication surface but nearly a dozen, each with its own protocol semantics and detection profile. For authorized assessors it consolidates endpoint-specific credential validation that would otherwise require a shelf of single-purpose scripts; for defenders it is a checklist of the virtual directories that deserve monitoring for authentication anomalies. Both audiences benefit from reading its per-endpoint authentication matrix carefully — that matrix, more than the brute-forcing code around it, is the durable knowledge in this repository.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• oss-scanner for automated vulnerability auditing of open-source repositories


• Looping Wi-Fi audits on foot with CyclePatrol, a single Bash orchestrator


• kev-data for programmatic access to the CISA known exploited vulnerabilities catalog