Azure JSON Web Token ("JWT") Manipulation (https://www.kitploit.com/search/label/Manipulation) Toolset Azure access tokens allow you to authenticate to certain endpoints (https://www.kitploit.com/search/label/Endpoints) as a user who signs in with a device code. Even if they used multi-factor authentication. Once you have a user's access token, it may be possible to access certain apps such as Outlook, SharePoint, OneDrive, MSTeams and more. For instance, if you have a Graph or MSGraph token, you can then connect to Azure and dump users, groups, etc. You could then, depending on conditional access policies, switch to an Azure Core Management (https://www.kitploit.com/search/label/Management) token and run AzureHound (https://github.com/BloodHoundAD/AzureHound). Then, switch to an Outlook token and read/send emails or MS Teams and read/send teams messages! For more on Azure token types Microsoft identity platform access tokens (https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens) There are some example requests to endpoints in the resources folder. There is also an example phishing template for device code phishing. You may also use these tokens with AAD Internals (https://o365blog.com/aadinternals/) as well. We strongly recommended to check this amazing tool out.
Installation and Usage
Import-Module .\TokenTactics.psd1 Get-Help Get-Azure-Token RefreshTo-SubstrateToken
Generate Device Code
Get-AzureToken -Client MSGraph Once the user has logged in, you'll be presented with the JWT and it will be saved in the $response variable. To access the access token (https://www.kitploit.com/search/label/Access%20Token) use $response.access_token from your PowerShell (https://www.kitploit.com/search/label/PowerShell) window to display the token. You may also display the refresh token with $response.refresh_token. Hint: You'll want the refresh token to keep refreshing to new tokens!
DOD/Mil Device Code
Get-AzureToken -Client DODMSGraph
Refresh or Switch Tokens
RefreshTo-OutlookToken -domain myclient.org -refreshToken ey.. $OutlookToken.access_token
Connect
Connect-AzureAD -AadAccessToken $response.access_token -AccountId user@myclient.org
Clear tokens
Clear-Token -Token All
Commands
Get-Command -Module TokenTactics

CommandType Name Version Source
----------- ---- ------- ------
Function Clear-Token 0.0.1 TokenTactics
Function Dump-OWAMailboxViaMSGraphApi 0.0.1 TokenTactics
Function Forge-UserAgent 0.0.1 TokenTactics
Function Get-AzureToken 0.0.1 TokenTactics
Function Get-TenantID 0.0.1 TokenTactics
Function Open-OWAMailboxInBrowser 0.0.1 TokenTactics
Function Parse-JWTtoken 0.0.1 TokenTactics
Function RefreshTo-AzureCoreManagementToken 0.0.1 TokenTactics
Funct ion RefreshTo-AzureManagementToken 0.0.1 TokenTactics
Function RefreshTo-DODMSGraphToken 0.0.1 TokenTactics
Function RefreshTo-GraphToken 0.0.1 TokenTactics
Function RefreshTo-MAMToken 0.0.1 TokenTactics
Function RefreshTo-MSGraphToken 0.0.1 TokenTactics
Function RefreshTo-MSManageToken 0.0.1 TokenTactics
Function RefreshTo-MSTeamsToken 0.0.1 TokenTactics
Function RefreshTo-O365SuiteUXToken 0.0.1 TokenTactics

Function RefreshTo-OfficeAppsToken 0.0.1 TokenTactics
Function RefreshTo-OfficeManagementToken 0.0.1 TokenTactics
Function RefreshTo-OutlookToken 0.0.1 TokenTactics
Function RefreshTo-SubstrateToken 0.0.1 TokenTactics
Authors and contributors
@0xBoku (https://github.com/boku7) co-author and researcher. TokenTactic's methods are highly influenced by the great research of Dr Nestori Syynimaa at https://o365blog.com/.

Download TokenTactics (https://github.com/rvrsh3ll/TokenTactics)

What’s the worst that can happen with reflected XSS?
https://www.reddit.com/r/Pentesting/comments/osvvb0/whats_the_worst_that_can_happen_with_reflected_xss/

<!-- SC_OFF -->I’ve found an issue in a web app where I can use a parameter in the url for reflected XSS. But I don’t know how big of an issue is it? I want to know so I can cash on the report in the same way. <!-- SC_ON --> submitted by /u/andenate08 (https://www.reddit.com/user/andenate08)
[link] (https://www.reddit.com/r/Pentesting/comments/osvvb0/whats_the_worst_that_can_happen_with_reflected_xss/) [comments] (https://www.reddit.com/r/Pentesting/comments/osvvb0/whats_the_worst_that_can_happen_with_reflected_xss/)

TokenTactics - Azure JWT Token Manipulation Toolset

Azure JSON Web Token ("JWT") Manipulation Toolset Azure access tokens allow you to authenticate to certain endpoints as a user who signs in with a device code. Even if they used multi-factor authentication. Once you have a user's access token, it may be possible to access certain apps such as Outlook, SharePoint, OneDrive, MSTeams and more. For instance, if you have a Graph or MSGraph token, you can then connect to Azure and dump users, groups, etc. You could then, depending on conditional access policies, switch to an Azure Core Management token and run AzureHound. Then, switch to an Outlook token and read/send emails or MS Teams and read/send teams messages! For more on Azure token types Microsoft identity platform access tokens There are some example requests to endpoints in the resources folder. There is also an example phishing template for device code phishing. You may also use these tokens with AAD Internals as well. We strongly recommended to check this amazing tool out.Installation and Usage Import-Module .\TokenTactics.psd1 Get-Help Get-Azure-Token RefreshTo-SubstrateToken Generate Device Code Get-AzureToken -Client MSGraph Once the user has logged in, you'll be presented with the JWT and it will be saved in the $response variable. To access the access token use $response.access_token from your PowerShell window to display the token. You may also display the refresh token with $response.refresh_token. Hint: You'll want the refresh token to keep refreshing to new tokens! DOD/Mil Device Code Get-AzureToken -Client DODMSGraph Refresh or Switch Tokens RefreshTo-OutlookToken -domain myclient.org -refreshToken ey.. $OutlookToken.access_token Connect Connect-AzureAD -AadAccessToken $response.access_token -AccountId user@myclient.org Clear tokens Clear-Token -Token All Commands Get-Command -Module TokenTacticsCommandType Name Version Source----------- ---- ------- ------Function Clear-Token 0.0.1 TokenTacticsFunction Dump-OWAMailboxViaMSGraphApi 0.0.1 TokenTacticsFunction Forge-UserAgent 0.0.1 TokenTacticsFunction Get-AzureToken 0.0.1 TokenTacticsFunction Get-TenantID 0.0.1 TokenTacticsFunction Open-OWAMailboxInBrowser 0.0.1 TokenTacticsFunction Parse-JWTtoken 0.0.1 TokenTacticsFunction RefreshTo-AzureCoreManagementToken 0.0.1 TokenTacticsFunct ion RefreshTo-AzureManagementToken 0.0.1 TokenTacticsFunction RefreshTo-DODMSGraphToken 0.0.1 TokenTacticsFunction RefreshTo-GraphToken 0.0.1 TokenTacticsFunction RefreshTo-MAMToken 0.0.1 TokenTacticsFunction RefreshTo-MSGraphToken 0.0.1 TokenTacticsFunction RefreshTo-MSManageToken 0.0.1 TokenTacticsFunction RefreshTo-MSTeamsToken 0.0.1 TokenTacticsFunction RefreshTo-O365SuiteUXToken 0.0.1 TokenTacticsFunction RefreshTo-OfficeAppsToken 0.0.1 TokenTacticsFunction RefreshTo-OfficeManagementToken 0.0.1 TokenTacticsFunction RefreshTo-OutlookToken 0.0.1 TokenTacticsFunction RefreshTo-SubstrateToken 0.0.1 TokenTactics Authors and contributors @0xBoku co-author and researcher. TokenTactic's methods are highly influenced by the great research of Dr Nestori Syynimaa at https://o365blog.com/. Download TokenTactics
Read more...

hacking: security in practice
What’s the worst that can happen with reflected XSS?

I’ve found an issue in a web app where I can use a parameter in the url for reflected XSS. But I don’t know how big of an issue is it?

I want to know so I can cash on the report in the same way.

submitted by /u/andenate08
[link] [comments]

How Not to Get Hacked on Telegram
https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2?source=rss------bug_bounty-5

The lightweight chat client Telegram is one of the most common methods of communication in crypto, and there’s a good reason for that. SIM…Continue reading on Immunefi » (https://medium.com/immunefi/how-not-to-get-hacked-on-telegram-2db2b93a5fa2?source=rss------bug_bounty-5)

Is port scanning on external pentest still relevant?
https://www.reddit.com/r/Pentesting/comments/osxmm1/is_port_scanning_on_external_pentest_still/

<!-- SC_OFF -->Do you still perform port scanning on external pentest? Or do you just focusing on web app testing only? The reason I'm asking this is port scanning doesn't seems so efficient nowadays as there are more security devices protecting the parameter such as firewall, waf, etc. I used to get immediate result, but nowadays it takes like forever for certain site. <!-- SC_ON --> submitted by /u/w0lfcat (https://www.reddit.com/user/w0lfcat)
[link] (https://www.reddit.com/r/Pentesting/comments/osxmm1/is_port_scanning_on_external_pentest_still/) [comments] (https://www.reddit.com/r/Pentesting/comments/osxmm1/is_port_scanning_on_external_pentest_still/)

Hacking on Medium
How Not to Get Hacked on Telegram

https://cdn-images-1.medium.com/max/2600/1*TJMlSskm4YqOhY2WDz5UkA.jpeg
The lightweight chat client Telegram is one of the most common methods of communication in crypto, and there’s a good reason for that. SIM…

Continue reading on Immunefi »

Hacking on Medium
47 Insanely Useful Websites You Probably Have Never Seen

https://cdn-images-1.medium.com/max/612/0*cnKxVcS5HG90eA-L
These websites will give you a jaw-dropping experience, and you will embrace the ~world wide~ web even more.

Continue reading on Medium »

How Not to Get Hacked on Telegram

The lightweight chat client Telegram is one of the most common methods of communication in crypto, and there’s a good reason for that. SIM…Continue reading on Immunefi »
Read more...

hacking: security in practice
Anyone have any troubleshooting tips for a rubber ducky??

So I've been messing around with my own laptops with a rubber ducky and have gotten to execute a script to download a payload from a server and have netcat listen for a connection. I have had it work wonderfully and on multiple occasions over the past week and now, all of a sudden, it won't work. I've noticed that the file is now downloaded maybe once every 3 times and the connection is never fully made to netcat. My target system is Windows 10 while my host system is running Kali Linux. It's a simple command to run a PowerShell script hidden to download and execute a ps1 file from a specific webserver. I've only been using it internally on my network.

submitted by /u/Caddburry00
[link] [comments]

Hacking on Medium
Healthcare VulnHub Writeup

https://cdn-images-1.medium.com/max/1649/1*lzBq07WHid4t3liTpxreiA.png
This was a fun box. Given that my main occupation is in healthcare, it seemed fitting that I should attempt it. It was a fun box, but very…

Continue reading on Medium »