Mastering Token Access: Uncovering Microsoft Graph API Secrets

John Hammond · Intermediate ·🧠 Large Language Models ·1y ago

Key Takeaways

The video demonstrates how to master token access and uncover Microsoft Graph API secrets, with a focus on social engineering and exploiting low-privilege accounts.

Full Transcript

they fell for our scheme and social engineering we've gained access to their tokens and their session to continue to work and interact with the Microsoft graph API and do everything we might do in entra ID but bear in mind this is just a low privilege account it's not a global administrator like we started with so what could we do

Original Description

https://youtube.com/watch?v=Ih4u2LV1BIc
Watch on YouTube ↗ (saves to browser)
Sign in to unlock AI tutor explanation · ⚡30

Playlist

Uploads from John Hammond · John Hammond · 0 of 60

← Previous Next →
1 Code Commentaries? PHP to JavaScript in Bash and PHP!
Code Commentaries? PHP to JavaScript in Bash and PHP!
John Hammond
 2 Tutorials? MySQL connection with PHP and Bash!
Tutorials? MySQL connection with PHP and Bash!
John Hammond
 3 Variable Naming in Python! Happy Birthday, Linux! Nokia N900!
Variable Naming in Python! Happy Birthday, Linux! Nokia N900!
John Hammond
 4 JavaScript Splits The URL!
JavaScript Splits The URL!
John Hammond
 5 HTML Tables in Python!
HTML Tables in Python!
John Hammond
 6 HTML, Net Shares, GML!
HTML, Net Shares, GML!
John Hammond
 7 Python 08 Programming Style and Comments
Python 08 Programming Style and Comments
John Hammond
 8 Python 26 Object Oriented Programming
Python 26 Object Oriented Programming
John Hammond
 9 75 Python Tutorials, Out Now!
75 Python Tutorials, Out Now!
John Hammond
 10 Batch 14 Mathematical Expressions
Batch 14 Mathematical Expressions
John Hammond
 11 Batch 85 Array Append
Batch 85 Array Append
John Hammond
 12 Batch 86 Array Count
Batch 86 Array Count
John Hammond
 13 Batch 87 Array Index
Batch 87 Array Index
John Hammond
 14 Batch 88 Array Insert
Batch 88 Array Insert
John Hammond
 15 Batch 89 Array Remove
Batch 89 Array Remove
John Hammond
 16 Batch 90 Array Reverse
Batch 90 Array Reverse
John Hammond
 17 Python [colorama] 00 Installing on Linux
Python [colorama] 00 Installing on Linux
John Hammond
 18 Python [colorama] 09 Cursor Position
Python [colorama] 09 Cursor Position
John Hammond
 19 Python [hashlib] 02 Algorithms
Python [hashlib] 02 Algorithms
John Hammond
 20 Python 00 Installing IDLE on Linux
Python 00 Installing IDLE on Linux
John Hammond
 21 Python [pygame] 11 Rectangular Collision Detection
Python [pygame] 11 Rectangular Collision Detection
John Hammond
 22 Python [pygame] 12 Platforming Rectangular Collision Resolution
Python [pygame] 12 Platforming Rectangular Collision Resolution
John Hammond
 23 Python [XML-RPC] 01 Research
Python [XML-RPC] 01 Research
John Hammond
 24 Python [pyenchant] 03 Personal Word Lists
Python [pyenchant] 03 Personal Word Lists
John Hammond
 25 FancyURLopener Authentication and User-Agent [urllib] 03
FancyURLopener Authentication and User-Agent [urllib] 03
John Hammond
 26 Python 04: PEP8 Coding
Python 04: PEP8 Coding
John Hammond
 27 Python Challenge! 17 COOKIES
Python Challenge! 17 COOKIES
John Hammond
 28 Google CTF 2016: Ernst Echidna
Google CTF 2016: Ernst Echidna
John Hammond
 29 Google CTF 2016: Spotted Quoll
Google CTF 2016: Spotted Quoll
John Hammond
 30 Google CTF 2016: Can you Repo It?
Google CTF 2016: Can you Repo It?
John Hammond
 31 Google CTF 2016: No Big Deal
Google CTF 2016: No Big Deal
John Hammond
 32 Google CTF 2016: In Recorded Conversation
Google CTF 2016: In Recorded Conversation
John Hammond
 33 Homemade CTF Challenge: 01 "Orchestra"
Homemade CTF Challenge: 01 "Orchestra"
John Hammond
 34 Homemade CTF Challenge: 02 "Bae's Base"
Homemade CTF Challenge: 02 "Bae's Base"
John Hammond
 35 Homemade CTF Challenge: 03 "Web Hunt"
Homemade CTF Challenge: 03 "Web Hunt"
John Hammond
 36 Homemade CTF Challenge: 04 "UPX"
Homemade CTF Challenge: 04 "UPX"
John Hammond
 37 Homemade CTF Challenge: 05 "The Assumption Song"
Homemade CTF Challenge: 05 "The Assumption Song"
John Hammond
 38 Homemade CTF Challenge: 06 "A Brisk Stroll"
Homemade CTF Challenge: 06 "A Brisk Stroll"
John Hammond
 39 Homemade CTF Challenge: 06 "I lost my password!"
Homemade CTF Challenge: 06 "I lost my password!"
John Hammond
 40 web25 :: Mr. Robot : EKOPARTY CTF 2016
web25 :: Mr. Robot : EKOPARTY CTF 2016
John Hammond
 41 web50 : RFC 7230 :: EKOPARTY CTF 2016
web50 : RFC 7230 :: EKOPARTY CTF 2016
John Hammond
 42 misc50 : Hidden inside EKO :: EKOPARTY CTF 2016
misc50 : Hidden inside EKO :: EKOPARTY CTF 2016
John Hammond
 43 Hack The Vote 2016 CTF: Sander's Fan Club [web100]
Hack The Vote 2016 CTF: Sander's Fan Club [web100]
John Hammond
 44 Hack The Vote 2016 CTF Warpspeed [forensics150]
Hack The Vote 2016 CTF Warpspeed [forensics150]
John Hammond
 45 Juniors CTF 2016 :: Black Suprematic Square
Juniors CTF 2016 :: Black Suprematic Square
John Hammond
 46 Juniors CTF 2016 :: Six Strange Tales
Juniors CTF 2016 :: Six Strange Tales
John Hammond
 47 Juniors CTF 2016 :: Lost Code
Juniors CTF 2016 :: Lost Code
John Hammond
 48 Juniors CTF 2016 :: Here Goes!
Juniors CTF 2016 :: Here Goes!
John Hammond
 49 Juniors CTF 2016 :: Southern Cross
Juniors CTF 2016 :: Southern Cross
John Hammond
 50 Juniors CTF 2016 :: Clone Attack
Juniors CTF 2016 :: Clone Attack
John Hammond
 51 Juniors CTF 2016 :: Dirty Repo
Juniors CTF 2016 :: Dirty Repo
John Hammond
 52 Juniors CTF 2016 :: Hackers Blog
Juniors CTF 2016 :: Hackers Blog
John Hammond
 53 Juniors CTF 2016 :: Voting!!!
Juniors CTF 2016 :: Voting!!!
John Hammond
 54 Juniors CTF 2016 :: The Good, The Bad and The Junkman
Juniors CTF 2016 :: The Good, The Bad and The Junkman
John Hammond
 55 Juniors CTF 2016 :: Stop Thief!
Juniors CTF 2016 :: Stop Thief!
John Hammond
 56 Juniors CTF 2016 :: ROFL
Juniors CTF 2016 :: ROFL
John Hammond
 57 Juniors CTF 2016 :: Restriced Area
Juniors CTF 2016 :: Restriced Area
John Hammond
 58 Juniors CTF 2016 :: Oh SSH!
Juniors CTF 2016 :: Oh SSH!
John Hammond
 59 HackCon CTF 2017 TRIVIA and BONUS Challenges
HackCon CTF 2017 TRIVIA and BONUS Challenges
John Hammond
 60 HackCon CTF 2017 "Bacche" Challenges
HackCon CTF 2017 "Bacche" Challenges
John Hammond

This video teaches how to gain access to Microsoft Graph API tokens and session information through social engineering, and how to use this access to interact with the API. It highlights the importance of API security and the potential risks of low-privilege accounts.

Key Takeaways
  1. Conduct social engineering attacks to gain access to user credentials
  2. Use the obtained credentials to gain access to Microsoft Graph API tokens and session information
  3. Interact with the Microsoft Graph API using the obtained tokens and session information
  4. Exploit low-privilege accounts to gain access to sensitive information
  5. Bypass API security measures to gain unauthorized access
💡 Low-privilege accounts can be exploited to gain access to sensitive information and interact with the Microsoft Graph API, highlighting the importance of robust API security measures.

Related Reads

📰
Building an open-source offline voice assistant with Ollama—looking for contributors and brutally honest feedback
Learn how to build an open-source offline voice assistant using Ollama and contribute to the AURA project for a private and extensible AI experience
Dev.to AI
 📰
Optimizing LLM Inference for Human-Computer Interaction
Optimize LLM inference for human-computer interaction to achieve low latency and high responsiveness, crucial for user experience
Dev.to AI
 📰
Open-Weight LLM API Integration: A Developer's Guide to Flexible AI Integration
Learn to integrate open-weight LLM APIs for flexible AI integration, enabling fine-grained control and vendor-agnostic solutions
Dev.to AI
 📰
Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer
OpenAI's GPT-Red LLM super-hacker strengthens model defenses against cyberattacks, making GPT-5.6 the most robust release yet
MIT Technology Review
Up next
5 Levels of AI Agents - From Simple LLM Calls to Multi-Agent Systems
Dave Ebbelaar (LLM Eng)
Watch →