TokenTactics is a Azure JSON Web Token (“JWT”) Manipulation Toolset.
Azure access tokens allow you to authenticate to certain endpoints as a user who signs in with a device code. Even if they used multi-factor authentication. Once you have a user’s access token, it may be possible to access certain apps such as Outlook, SharePoint, OneDrive, MSTeams and more.
For instance, if you have a Graph or MSGraph token, you can then connect to Azure and dump users, groups, etc. You could then, depending on conditional access policies, switch to an Azure Core Management token and run AzureHound. Then, switch to an Outlook token and read/send emails or MS Teams and read/send teams messages!
For more on Azure token types Microsoft identity platform access tokens
There are some example requests to endpoints in the resources folder. There is also an example phishing template for device code phishing.
You may also use these tokens with AAD Internals as well. We strongly recommended to check this amazing tool out.
Installation And Usage
Import-Module .\TokenTactics.psd1
Get-Help Get-Azure-Token
RefreshTo-SubstrateToken
Get-AzureToken -Client MSGraph Once the user has logged in, you’ll be presented with the JWT and it will be saved in the $response variable. To access the access token use $response.access_token from your PowerShell window to display the token. You may also display the refresh token with $response.refresh_token. Hint: You’ll want the refresh token to keep refreshing to new tokens!
Get-AzureToken -Client DODMSGraph
RefreshTo-OutlookToken -domain myclient.org -refreshToken ey..
$OutlookToken.access_token
Connect-AzureAD -AadAccessToken $response.access_token -AccountId user@myclient.org
Clear-Token -Token All
Get-Command -Module TokenTactics
CommandType Name Version Source
———– —- ——- ——
Function Clear-Token 0.0.1 TokenTactics
Function Dump-OWAMailboxViaMSGraphApi 0.0.1 TokenTactics
Function Forge-UserAgent 0.0.1 TokenTactics
Function Get-AzureToken 0.0.1 TokenTactics
Function Get-TenantID 0.0.1 TokenTactics
Function Open-OWAMailboxInBrowser 0.0.1 TokenTactics
Function Parse-JWTtoken 0.0.1 TokenTactics
Function RefreshTo-AzureCoreManagementToken 0.0.1 TokenTactics
Function RefreshTo-AzureManagementToken 0.0.1 TokenTactics
Function RefreshTo-DODMSGraphToken 0.0.1 TokenTactics
Function RefreshTo-GraphToken 0.0.1 TokenTactics
Function RefreshTo-MAMToken 0.0.1 TokenTactics
Function RefreshTo-MSGraphToken 0.0.1 TokenTactics
Function RefreshTo-MSManageToken 0.0.1 TokenTactics
Function RefreshTo-MSTeamsToken 0.0.1 TokenTactics
Function RefreshTo-O365SuiteUXToken 0.0.1 TokenTactics
Function RefreshTo-OfficeAppsToken 0.0.1 TokenTactics
Function RefreshTo-OfficeManagementToken 0.0.1 TokenTactics
Function RefreshTo-OutlookToken 0.0.1 TokenTactics
Function RefreshTo-SubstrateToken 0.0.1 TokenTactics
Pip is the official package manager for Python and the standard way to install libraries from…
R is an open-source programming language and environment built for statistical computing and data visualization. It…
Jenkins is an open-source automation server that makes it easy to build CI/CD pipelines. Continuous integration…
Android Studio is the official IDE for Android development, built on JetBrains' IntelliJ IDEA platform. It…
GitLab is a web-based, open-source Git repository manager written in Ruby. It includes built-in tools for…
Anaconda is the most widely used Python distribution for data science and machine learning. It bundles…