Why yes, yes we can use ESTSAUTH captured from evilginx to automatically register a passkey

This is quite different than my previous scripts btw. Those were all based on a service principal with API permissions, but AitM won't have that. Instead, this uses the user's ESTSAUTH cookie to request tokens for My Signins and registers a passkey using delegated permissions

There are a lot of mitigations for this: Enforce attestation for passkeys Use CA policies to secure registering security info (auth strengths, location, etc.) Require compliance device or compliant network Or always require phishing resistant auth in the first place ;)

Unfortunately, if you want to allow synced passkeys, this is your attack surface At the very least, you need to enforce phishing resistant auth only for those users once they have registered them - avoid the downgrade attacks ⚠️ Always check for passkeys on compromised accounts

@cgomezz_23 This is incredible! 🪝🐟

@cgomezz_23 Thanks for the nudge to check it out Honestly, this bothers me how easy it was to put this together, because I likely might have shrugged this off before This is why I published the script, because I don't want to get complacent or have people argue "well, in theory..." :)

@mrgretzky @cgomezz_23 This is very cool! Can I ask where you published the script please? I'd like to check it out...

@mrgretzky @cgomezz_23 Sure, it will work with ESTSAUTH obtained through any method btw ;)

@mrgretzky @cgomezz_23 Thanks!

@mrgretzky @cgomezz_23 Yeah, lmk if you have any questions or hit issue Typically we have about 5 minutes to use the tokens to register a new auth method, but I tried to mimic the timeout/renew logic so we could refresh and still do it It seemed to work, but there may be edge cases :p

You’re so clever :) I never ceased to be amazed..

Thanks! A little dev tools, HAR spelunking, and tossing the complicated issues at AI until it starts working, lol

Don’t we all, still always very good! I should probably spend more time publishing my random tidbits too!