Thread by @_wald0

Problem: you want to collect data with AzureHound but you can't use simple username/password because your user:

❌ - Requires MFA
❌ - Can't auth due to a CAP
❌ - Is a guest/federated user in the target tenant

Solution: refresh tokens! Sounds scary and new? They're EASY: 🧵

There are MANY ways to get your hands on a refresh token, but I think by far the simplest is by using the OAuth 2.0 device code flow.

Sounds complicated but it's a very easy three-step process:

Step 1: initialize a device code authentication flow with this very simple POST request.

Note the "user_code" and "verification_url" we get back:

Step 2: Open a browser where your user is already logged in to an Azure service (the portal, for example). Navigate to the above URL in that browser.

Enter the code from above when asked for it. Follow the prompts until you see this screen:

Step 3: You're ready to get your refresh token! Go back to your PowerShell prompt and perform this very easy POST request.

You now have a refresh token!

Now you can feed this refresh token to AzureHound and do your data collection without being affected by MFA, CAPs, or guest/federated user issues.

This page on the #BloodHound documentation has all the above info and commands for easy copy/pasting: bloodhound.readthedocs.io/en/latest/data…