Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Feature Request] Add Python module for Stealing Application Access Tokens

未关闭
  • 哪里不对？
#9 0 条评论 0 个 reaction 已指派 2 人 在 GitHub 查看

@terrancedejesus 已经在做这个了。

开始于 2023年5月10日。

评估

这个 Issue 还没有评估数据。

描述

API: Admin enhancement Tactic: Credential Access Technique: T1528

🐍 Python Module for MITRE ATT&CK Technique

Tactic Name: Credential Access

Technique Name: Steal Application Access Token

Technique ID: T1528

Technique Description: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Describe the solution you'd like

A Application Access Token Stealing Module for use with a compromised GWS environment for Credential Access.

Requirements: 
- Google Admin SDK API enabled
- Python packages (google-auth google-auth-oauthlib google-auth-httplib2 google-api-python-client, email, base64)
- Scopes (https://www.googleapis.com/auth/admin.directory.user)

Module Workflow:
Step 1: Collect all available Application Access Tokens 

Module Actions:
 1. Authenticate
 2. Build the Directory API client
 3. Retrieve the list of application access tokens
 4. Print the access tokens

ChatGPT Example Script

from google.oauth2 import service_account
from googleapiclient.discovery import build

# replace with the path to your service account key file
KEY_FILE_LOCATION = '/path/to/service_account_key.json'

# replace with your customer ID
CUSTOMER_ID = 'my_customer'

# replace with your scope
SCOPE = 'https://www.googleapis.com/auth/admin.directory.group.member.readonly'

# create credentials from service account key file
credentials = service_account.Credentials.from_service_account_file(KEY_FILE_LOCATION, scopes=[SCOPE])

# build the Directory API client
directory_service = build('admin', 'directory_v1', credentials=credentials)

# retrieve the list of application access tokens
results = directory_service.tokens().list(customer=CUSTOMER_ID).execute()

# print the access tokens
for token in results.get('items', []):
    print(token.get('applicationName'), token.get('kind'), token.get('clientId'), token.get('scopes'))
主要语言
Python
星标
171
派生
8
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

elastic/SWAT 的其他 Issue

查看 elastic/SWAT 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。