{"repo":"AlteredSecurity/365-Stealer","free":true,"listed":false,"github":"https://github.com/AlteredSecurity/365-Stealer","clone":"git clone https://github.com/AlteredSecurity/365-Stealer.git","description":"365-Stealer is a phishing simualtion tool written in python3. It can be used to execute Illicit Consent Grant Attack.","language":"PHP","stars":585,"topics":["azuread","azure","phishing","redteam","pentesting"],"license":null,"category":"security-tools","readme_excerpt":"365-Stealer Table of Contents - About 365-Stealer - About Illicit Consent Grant Attack - Key Features of 365-Stealer - Setup Attacking Environment - Automated Azure App Registration - Manual Azure App Registration - Configuring the Application - Creating Client Secrets - Adding API Permissions - Setting Up 365-Stealer - Enabling SQLite3 on the Apache Server - Configuring the 365-Stealer Management Portal - Modifying Paths - Enabling IP Whitelisting for the 365-Stealer Management Portal - OPSEC Consideration - Command Line Help - Blog - Bugs and Feature Requests - Contributing About 365-Stealer is a Python3-based tool designed to automate illicit consent grant attacks. When a target user unknowingly grants permission to an attacker's application, the attacker gains access to the victim's refresh token. This refresh token can then be used to generate other tokens, allowing the attacker to access sensitive data such as emails, files on OneDrive, and notes—without needing further input from the victim. Manually exploiting this can be time-consuming, but 365-Stealer simplifies and automates the process. 365-Stealer comes with 2 interfaces: 1. CLI (Command Line Interface) - Built entirely in Python3, the CLI provides direct access to the tool’s features. 2. Web UI - The Web User Interface is developed using PHP, while Python3 operates in the background to execute commands. Understanding the Illicit Consent Grant Attack An illicit consent grant attack occurs when an attacker registe","default_branch":null,"files":null,"tree":[],"storefront":"/r/AlteredSecurity","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/AlteredSecurity/365-Stealer/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}