How mbrg/power-pwn works
Power Pwn is a command-line security toolkit for Microsoft 365 Power Platform and AI services. The principal workflow is to select a command, parse its options, dispatch it, and run a tenant scan or targeted security assessment; results may be viewed through the PowerDump GUI. Separate capabilities cover Copilot testing, bot and agent discovery, exposed MCP probing, flow persistence, artifact abuse, phishing, and Power Pages checks. The sampled CLI confirms dispatch, and sampled Copilot and LLM Hound code confirms some internal calls. Runner implementations were not sampled, so links from runners to their feature modules are dashed and unverified.
Main entry points: runners.py Command Runners · llmhound.py LLM Hound · copilot_connector.py Copilot Connector · arguments.py CLI Arguments
Components 23
Command Interface
- CLI Arguments
src/powerpwn/cli/arguments.py - Command Dispatcher
src/powerpwn/main.py - Command Runners
src/powerpwn/cli/runners.py
Tenant Assessment
- PowerDump
src/powerpwn/powerdump/collect - Results GUI
src/powerpwn/powerdump/gui/gui.py - Tenant Recon
src/powerpwn/powerdump/collect/resources_collectors/resources_collector.py
AI Security
- M365 Copilot
src/powerpwn/copilot/interactive_chat/interactive_chat.py - Copilot Connector
src/powerpwn/copilot/copilot_connector/copilot_connector.py - Bearer Retrieval
puppeteer_get_substrate_bearer/get_substrate_bearer_office.js - Chat Automation
src/powerpwn/copilot/chat_automator/chat_automator.py - WebSocket Parsing
src/powerpwn/copilot/websocket_message/websocket_message.py - Copilot Studio Hunter
src/powerpwn/copilot_studio/modules - Custom GPT Hunter
src/powerpwn/custom_gpt_hunter/custom_gpt_hunter.js - Agent Builder Hunter
src/powerpwn/agent_builder/agent_builder_scan.py - LLM Hound
src/powerpwn/llmhound/llmhound.py - Shodan Discovery
src/powerpwn/llmhound/shodan_discovery.py - Registry Discovery
src/powerpwn/llmhound/registry_discovery.py - MCP Probe
src/powerpwn/llmhound/server_probe.py
Power Platform Actions
- BackDoor Flows
src/powerpwn/powerdoor/backdoor_flow.py - NoCodeMalware
src/powerpwn/nocodemalware/malware_runner.py - PowerPhishing
src/powerpwn/powerphishing/app_installer.py - Power Pages
src/powerpwn/powerpages/powerpages.py
Other components
- Operator
Connections 22
- Operator → CLI Arguments: supplies options
src/powerpwn/cli/arguments.py - CLI Arguments → Command Dispatcher: returns parsed args
src/powerpwn/main.py - Command Dispatcher → Command Runners: dispatches commands
src/powerpwn/main.py - Command Runners → PowerDump: runs scan
- Command Runners → Tenant Recon: runs recon
- Command Runners → Results GUI: opens results
- Command Runners → M365 Copilot: runs tests
- Command Runners → Copilot Studio Hunter: hunts bots
- Command Runners → Custom GPT Hunter: hunts GPTs
- Command Runners → Agent Builder Hunter: hunts agents
- Command Runners → LLM Hound: discovers MCPs
- Command Runners → BackDoor Flows: deploys flows
- Command Runners → NoCodeMalware: runs artifacts
- Command Runners → PowerPhishing: installs phishing
- Command Runners → Power Pages: checks pages
- M365 Copilot → Copilot Connector: starts connection
src/powerpwn/copilot/interactive_chat/interactive_chat.py - Copilot Connector → Bearer Retrieval: retrieves token
src/powerpwn/copilot/copilot_connector/copilot_connector.py - Copilot Connector → WebSocket Parsing: parses messages
src/powerpwn/copilot/copilot_connector/copilot_connector.py - Chat Automation → Copilot Connector: uses connection
src/powerpwn/copilot/chat_automator/chat_automator.py - LLM Hound → MCP Probe: probes servers
src/powerpwn/llmhound/llmhound.py - LLM Hound → Shodan Discovery: discovers servers
src/powerpwn/llmhound/llmhound.py - LLM Hound → Registry Discovery: discovers registry
src/powerpwn/llmhound/llmhound.py