OAuth Device Code Authorization Phishing Script
Some scripts to utilise device code authorization for phishing. High level overview as per the instructions as: https://o365blog.com/post/phishing/ An attacker connects to /devicecode endpoint and sends client_id and resource After receiving verification_uri and user_code, create an email containing a link to verification_uri and user_code, and send it to the victim. (delivering the phishing email is not in scope for this project) Victim clicks the link, provides the code and completes the sign in. The attacker receives access_token and refresh_token and […]
Read more