TokenLook

TokenLook is a complete toolkit for Extraction and Use of JWT tokens from Outlook process memory (Deprecated Outlook Mail REST API)

Note: WIKI documentation is still being updated

WiKi

For detailed documentation and use refer to:- https://github.com/vrikodar/TokenLook/wiki

References

• https://learn.microsoft.com/en-us/previous-versions/office/office-365-api/api/version-2.0/mail-rest-operations
• https://blog.xpnsec.com/wam-bam/
• https://mrd0x.com/stealing-tokens-from-office-applications/

Important thing(s) to note

TokenLook has been successfully tested against enterprise O365 accounts, email accounts created directly on "outlook.com" usually don't work with this tool, as during testing it was found that these accounts tend to use different APIs than the usual "Outlook Mail REST API".

Future updates currently under development (-->TODO-->)

1. Documentation on deployment of web server for remote extraction
2. WebUI Development for TokenLook, gives seamless control over whole process of extraction and use
3. IMP Modification in main.py where the tool in initial run will just parse all the available JWTs and then ask the user to select the context to proceed with.