power-pwn is an offensive-and-defensive security toolset for auditing Microsoft 365 Power Platform, Copilot Studio, custom GPTs, and exposed AI middleware in authorized engagements.
| Tool | mbrg/power-pwn — an offensive/defensive security toolset for Microsoft 365 Power Platform and AI services |
| Category | Cloud and AI attack-surface assessment tooling (Python, MIT) |
| Primary Use | Authorized tenant assessments: scanning M365 tenants with PowerDump, hunting misconfigured Copilot Studio bots, and testing Copilot for unauthorized data retrieval |
| Safe Use | For penetration testers and security teams with written authorization over the tenant being assessed, internal purple-team exercises, and defenders validating misconfiguration exposure |
| Telemetry Note | Modules authenticate against Microsoft 365 and generate audit-visible activity in Entra ID and Power Platform logs; LLM Hound queries Shodan, leaving external scan telemetry rather than touching targets directly |
power-pwn is a Python-based security toolset maintained by Zenity that targets one of the most under-audited corners of the modern enterprise: the Microsoft Power Platform, low-code automation, and the growing fleet of AI agents layered on top of Microsoft 365. The project, written in Python and released under the MIT license, has accumulated over twelve hundred stars on GitHub and carries the credibility markers that matter in this niche — Arsenal appearances at Black Hat USA 2023 and 2024, DEF CON 30, and SecTor 23. It is explicitly framed as both offensive and defensive tooling, which is accurate: nearly every module has a natural defender-side interpretation, since the misconfigurations it surfaces are exactly what tenant administrators need to find and close.
The README organizes the toolset into named modules rather than a monolithic scanner, and the architecture reflects that. PowerDump is positioned as the entry point — a comprehensive tenant scanning and data collection capability that maps what exists in a Microsoft 365 tenant and where security issues lurk. The project's own quick-start guide tells the operational story: begin with PowerDump for a tenant security assessment, then pivot to the narrower modules depending on what the engagement calls for. That workflow discipline is a good sign of a mature tool rather than a weekend script.
The offensive side of the house is named bluntly. BackDoor deploys backdoor flows for persistent access to Power Platform environments, NoCodeMalware creates malicious Power Platform artifacts without writing code, and PowerPhishing abuses the platform's legitimate email and form capabilities for credential harvesting. We describe these here in documentary fashion — they exist in the tool, and understanding them is essential for defenders — but this article deliberately does not provide operational sequences for using them against systems you do not own. Their defensive value is precisely that they demonstrate, in a controlled lab, how native low-code primitives can be repurposed, which is the evidence a security team needs to justify hardening DLP policies and flow creation controls.
The AI-focused modules are where power-pwn has clearly invested its recent development energy, and they map neatly onto the industry's rush to deploy Copilot Studio bots, custom GPTs, and Agent Builder agents. Copilot Studio Hunter discovers and tests misconfigured Copilot Studio bots exposed to unauthenticated users, with the wiki breaking it into deep-scan, tools-recon, and enum submodules. Custom GPT Hunter enumerates and analyzes custom GPTs, while Agent Builder Hunter finds publicly available Agent Builder deployments and enumerates their capabilities. Together these address a real and current gap: organizations are publishing conversational agents with weak authentication and over-broad tool access, and nobody in the traditional SOC toolchain is looking for them.
LLM Hound is the most internet-wide of the modules — it discovers publicly exposed MCPs and AI middleware using Shodan, which means it functions largely as passive external reconnaissance against indexed infrastructure rather than direct interaction. For defenders, this is arguably the single most valuable module to run first: if LLM Hound can find your organization's Model Context Protocol servers or AI middleware through a public search engine, so can anyone else. The telemetry implication is worth noting — this module leaves traces in Shodan query logs, not in your own environment, and it should be run within the scope of what your engagement letter and applicable law permit regarding third-party scanning platforms.
Rounding out the capability set, Copilot M365 tests Microsoft 365 Copilot for unauthorized data retrieval, split into a whoami submodule that identifies the user context and permissions the copilot operates under and a dump submodule for testing data exfiltration scenarios — the classic indirect prompt-injection and over-permissive grounding concerns that have followed Copilot since launch. Power Pages closes the loop on the low-code web tier, identifying misconfigured Power Pages sites that leak underlying Dataverse tables. The breadth is notable: the tool covers flows, agents, chat interfaces, and external web surfaces, which is roughly the full Power Platform attack surface.
Installation is refreshingly standard for a tool of this ambition — pip install powerpwn is the documented path for standard usage, and the package exposes a powerpwn CLI with a --help menu shown in the README. For developers, the repository offers python init_repo.py --install-external-tools, which pulls in module-specific dependencies including ffuf, subfinder, Node.js, and Puppeteer. The presence of those dependencies is architecturally revealing: ffuf and subfinder imply content discovery and subdomain enumeration somewhere in the Copilot Studio and Power Pages hunting workflows, while Puppeteer suggests headless browser interaction for deep scanning of bot endpoints that require a rendered session.
The development guidance includes practical touches that indicate an actively maintained project: an editable install via pip install -e . for contributors, an explicit recommendation to use Python 3.11 for the GUI-bearing PowerDump module to avoid compatibility issues, PYTHONPATH setup notes for both POSIX shells and Windows PowerShell, and a code-formatting convention of black -C -l 150. The documentation footprint is substantial — a full wiki covering each module's prerequisites, plus a dedicated INSTALLATION.md with platform-specific instructions for macOS, Linux, and Windows, the last of which requires manual installation of the external tools. This is the level of documentation you want to see before deploying a scanner against a production tenant.
From a defensive standpoint, power-pwn is best understood as a misconfiguration aggregator for the SaaS-plus-AI era. Every module name corresponds to a class of finding that a defender can hunt for independently: unauthenticated Copilot Studio bots, public Agent Builder deployments leaking capability metadata, Power Pages exposing Dataverse tables, and Copilot grounding on data the querying user should not reach. Running the enum-oriented modules against your own tenant is a legitimate and low-risk audit activity, and the findings translate directly into Entra ID conditional access changes, Power Platform DLP policies, and Copilot Studio authentication requirements.
The tool's provenance adds context worth knowing. Maintainer Michael Bargury is affiliated with Zenity, a company whose entire business is securing AI agents, and the README's tagline — "Secure AI Agents Everywhere" — makes the commercial alignment explicit. That does not diminish the tool's utility; if anything, it explains why the AI modules are so much more developed than typical research code. The conference trail, the maintained wiki, and the structured contribution workflow all point to sustained investment rather than an abandoned proof-of-concept, which matters when you are deciding whether to add a tool to your authorized-assessment kit.
For the professional evaluating fit: if your scope is Microsoft 365, Power Platform, or the growing sprawl of enterprise AI agents, power-pwn consolidates what would otherwise be a dozen bespoke scripts into one CLI with coherent module boundaries. Approach the offensive modules with the seriousness their names demand, keep usage inside written authorization, and treat every result as a finding to remediate rather than a capability to celebrate. Used that way, it is one of the better instruments currently available for measuring how much accidental attack surface the low-code and AI-agent revolutions have created in the average tenant.
mbrg/power-pwn.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.