{"id":13782636,"url":"https://github.com/jsa2/aadcookiespoof","last_synced_at":"2025-07-09T07:31:17.141Z","repository":{"id":103263383,"uuid":"456365752","full_name":"jsa2/aadcookiespoof","owner":"jsa2","description":"Azure AD Identity Protection Cookie Spoofing","archived":false,"fork":false,"pushed_at":"2023-09-02T07:08:36.000Z","size":21,"stargazers_count":31,"open_issues_count":1,"forks_count":4,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-11-17T17:43:32.232Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jsa2.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-02-07T05:08:05.000Z","updated_at":"2024-10-06T16:24:31.000Z","dependencies_parsed_at":null,"dependency_job_id":"b4cc4dc5-8d53-4a54-b6f4-be9dd8b4ca3e","html_url":"https://github.com/jsa2/aadcookiespoof","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Faadcookiespoof","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Faadcookiespoof/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Faadcookiespoof/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsa2%2Faadcookiespoof/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jsa2","download_url":"https://codeload.github.com/jsa2/aadcookiespoof/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225492615,"owners_count":17482923,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T18:01:40.525Z","updated_at":"2024-11-20T08:39:34.544Z","avatar_url":"https://github.com/jsa2.png","language":"JavaScript","funding_links":[],"categories":["0x02 工具 :hammer_and_wrench:"],"sub_categories":["1 云服务工具"],"readme":"# Cookie replay client for testing Azure AD Identity Protection\n\nI made this client to test various features of [Azure AD Identity Protection](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection). \n\n📑 Based on testing it requires some 10-30 days of data before any alerts will fire from replayed cookies\n\n\u003cimg width=\"429\" alt=\"image\" src=\"https://user-images.githubusercontent.com/58001986/153801573-782f7ee7-f28c-4103-9218-4db34a30a528.png\"\u003e\n\n\n**Example**\n\nhttps://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#sign-in-risk\n\n\n*Unfamiliar sign-in properties can be detected on both interactive and non-interactive sign-ins. When this detection is detected on non-interactive sign-ins, it deserves increased scrutiny due to the risk of token replay attacks.*\n\n*This detection indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. This detection covers Session Tokens and Refresh Tokens.*\n\n---\n \n  ⚠ Only use this tool if you know what you are doing and have reviewed the code\n\n  ⚠ Always test the tool first in test environments, with non-sensitive data\n\n---\nAs the licenses says, 0%  Liability 0% Warranty\n\n\n\n## What does it do? \nUses the ESTSAUTH cookie for non device-SSO flow (Device SSO cookies require different attributes in the requests)\n1. Sends mail to user\n2. Gets user mail settings\n3. Tries to list user Azure Subscriptions\n4. Uploads random data from randomuser.me/api to onedrive\n\n\n## prereqs\n1. Azure Cloud Shell opened in BASH\n   \n\n2. Run setup\n`` curl -o- https://raw.githubusercontent.com/jsa2/aadcookiespoof/main/remote.sh | bash`` \n  \n\n## Spoofing\nFrom any browser perform fresh sign-in via https://office.com, then copy the **FIRST** occurence of ESTSAUTH cookie with fresh sign-in (use inPrivate browser to ensure no device flows are used, and no existing session is active)\n\n(If you are doing MFA get the token from the /SAS/ProcessAuth -step)\n\n![image](https://user-images.githubusercontent.com/58001986/199920119-9325edc1-fbea-4d01-b21b-70e15ea1368b.png)\n\n⚠️ Ensure you have MFA requirements satisified in the request if you plan to replay it from location that requires MFA. Otherwise replay from Cloud Shell will fail.\n\n![image](https://user-images.githubusercontent.com/58001986/152730258-ae782584-095a-400d-bbee-7532f96f6d8e.png)\n\n**Run following in bash to create the template**\n - paste the cookie contents to command\n```sh\necho '[ \n  {\n      \"user\":\"mega\",\n      \"cookie\":\"ESTSAUTH=0.AU8Aob9....\"\n  }\n]' \u003e cookies.json\n```\n\n❌ This tool checks the cookie length to match that of expected before proceeding. Don't select \"KMSI\" when signing\n\n\n**Spoof**\n\nRUN\n\n``` \ncd aadcookiespoof\nnode manual.js \n```\n\n\n![image](https://user-images.githubusercontent.com/58001986/152733612-77f64c18-df0a-4209-b4e9-88bdb1efbf74.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsa2%2Faadcookiespoof","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjsa2%2Faadcookiespoof","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsa2%2Faadcookiespoof/lists"}