Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack

Last update: Sep 23, 2022

Overview

O365DevicePhish

Microsoft365_devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack

This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints to create user_code and device_code and obtain victim user's access_token upon successfult phishing attack. Then, the token can be used to access various Office365 products via Microsoft Graph API on behalf of the victim user. In addition, this script was created to help a specific situation where a target organization was utilizaing an Email OTP (One-time Passcode) for their MFA option; thus, with a successful phishing attack, one could read a generated Email OTP code from victim user's email inbox to bypass MFA.

Usage

$ python3 devicePhish.py 
[INFO] Usage: python3 devicePhish.py 
   
    
[INFO] Example: python3 devicePhish.py fake-2ce0-4958-a61a-a5055ef62bf8

Example

Generating user_code and device_code from an Azure App:

Upon successfull phishing attack, obtaining access_token & refresh_token for a victim user:

After an Email OTP is triggered, reading the OTP code from the victim's email inbox:

After reading the Email OTP code, it deletes the OTP email:

Credits & References

Introducing a new phishing technique for compromising Office 365 accounts

Comments

[ImgBot] Optimize images

Beep boop. Your images are optimized!

Your image file size has been reduced by 14% 🎉

Details

| File | Before | After | Percent reduction | |:--|:--|:--|:--| | /2_tokens.png | 960.76kb | 826.30kb | 13.99% |

📝 docs | :octocat: repo | 🙋🏾 issues | 🏪 marketplace

~Imgbot - Part of Optimole family

opened by imgbot[bot] 0

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validatio

165 Dec 21, 2022

A repository to detect the ARP spoofing in any devices and prevent Man in the Middle(MITM) attack using Python3

arp_spoof_detector A repository to detect the ARP spoofing in any devices and prevent Man in the Middle(MITM) attack using Python3 Usage: git clone ht

1 Oct 30, 2021

Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)

CVE-2021-42694 Generate malicious files using recently published homoglyph-attack vulnerability, which was discovered at least in C, C++, C#, Go, Pyth

17 Dec 11, 2022

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

F2Amapper This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to

3 Sep 3, 2022

A (completely native) python3 wifi brute-force attack using the 100k most common passwords (2021)

Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack

Related tags

Overview

O365DevicePhish

Usage

Example

Credits & References

You might also like...

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

A repository to detect the ARP spoofing in any devices and prevent Man in the Middle(MITM) attack using Python3

Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

A (completely native) python3 wifi brute-force attack using the 100k most common passwords (2021)

Generate malicious files using recently published bidi-attack (CVE-2021-42574)

python script for hack gmail account using brute force attack

Facebook account cloning/hacking advanced tool + dictionary attack added | Facebook automation tool

Attack SQL Server through gopher protocol

Comments

[ImgBot] Optimize images

Beep boop. Your images are optimized!

Owner

Trewis [work] Scotch

This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform.

ThePhish: an automated phishing email analysis tool

Phishing-Crack tools to punish friends

WhPhisher: a Phishing tool With Python

Domain abuse scanner covering domainsquatting and phishing keywords.

Client script for the fisherman phishing tool

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

SARA - Simple Android Ransomware Attack

DirBruter is a Python based CLI tool. It looks for hidden or existing directories/files using brute force method. It basically works by launching a dictionary based attack against a webserver and analyse its response.

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.