Cookie replay client for testing Azure AD Identity Protection


I made this client to test various features of Azure AD Identity Protection.

📑 Based on testing it requires some 30 days of data, before any alerts will fire from replayed cookies



This detection indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. This detection covers Session Tokens and Refresh Tokens.

⚠ Only use this tool if you know what you are doing and have reviewed the code

⚠ Always test the tool first in test environments, with non-sensitive data

As the licenses says, 0% Liability 0% Warranty

What does it do?

Uses the ESTSAUTH cookie for non device-SSO flow (Device SSO cookies require different attributes in the requests)

  1. Sends mail to user
  2. Gets user mail settings
  3. Tries to list user Azure Subscriptions
  4. Uploads random data from randomuser.me/api to onedrive


  1. Azure Cloud Shell opened in BASH
  2. Run setup curl -o- https://raw.githubusercontent.com/jsa2/aadcookiespoof/main/remote.sh | bash


From any browser, copy the FIRST occurence of ESTSAUTH cookie with fresh sign-in (use inPrivate browser to ensure no device flows are used)

⚠️ Ensure you have MFA requirements satisified in the request if you plan to replay it from location that requires MFA. Otherwise replay from Cloud Shell will fail.


Run following in bash to create the template

  • paste the cookie contents to command
]' > cookies.json

❌ This tool checks the cookie length to match that of expected before proceeding. Don’t select ”KMSI” when signing



cd aadcookiespoof
node manual.js 


0 comments on “Cookie replay client for testing Azure AD Identity Protection


Täytä tietosi alle tai klikkaa kuvaketta kirjautuaksesi sisään:


Olet kommentoimassa WordPress.com -tilin nimissä. Log Out /  Muuta )


Olet kommentoimassa Facebook -tilin nimissä. Log Out /  Muuta )

Muodostetaan yhteyttä palveluun %s

%d bloggaajaa tykkää tästä: