Token Analysis and Tracking System (TATS)

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://specterops.io/blog/2026/09/08/token-analysis-and-tracking-system-tats
• Blog Title: Token Analysis and Tracking System (TATS)
• Suggested Section: Azure Pentesting > Az - Basic Information > Az - Tokens & Public Applications, with cross-references to Az - EntraID Privesc > Conditional Access Policies & MFA Bypass and Az - Lateral Movement (Cloud - On-Prem) > Pass the Cookie / Primary Refresh Token (PRT)

🎯 Content Summary

Overview

Token Analysis and Tracking System (TATS) is a Python-based research tool for collecting, storing, decoding, correlating, analyzing, and visually tracking OAuth token exchanges. It was designed to make Microsoft cloud authentication research easier, particularly because Microsoft implements ecosystem-specific OAuth behaviors such as brokered client IDs (BroCI) and Family of Client IDs (FOCI). TATS is intended to work with any OAuth implementation. Repository:...

🔧 Technical Details

OAuth token-exchange instrumentation: Collect browser or proxy traffic through Burp import, Chrome DevTools Protocol, or mitmproxy, persist token metadata in a database, decode JWT claims, assign each token a fingerprint, and correlate issuance, use, refresh-token inputs, and exchanged outputs. Use dashboard filters, Mermaid graphs, and sequence diagrams to identify client IDs, brokered applications, privileged scopes, authentication methods, CAE, token sources, and scope changes. Store complete token values with --store-tokens only when command or authentication-file export is required, use --enrich for application and broker metadata, and use --redact-claims before sharing collected data.

Audience-mismatch analysis: Compare a JWT's aud claim with the host receiving the token. A token issued for management.core.windows.net but presented to hosts such as management.azu...

🤖 Agent Actions

Updated:

src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md

Added:

• TATS installation and collection commands for Burp, mitmproxy, and CDP.
• Token fingerprinting, exchange correlation, and analysis pivots.
• Sensitive token storage and claim-redaction warnings.
• Audience/host mismatch validation methodology.
• Pre-MFA token issuance and downstream Conditional Access gap analysis.
• Cross-references to Conditional Access, Pass-the-Cookie, PRT, and BroCI sections.
• Numbered citations for the TATS repository, SpecterOps research, and Microsoft MFA documentation.

Validation passed for Markdown links, reference numbering, forbidden sources, and git diff --check. mdbook was unavailable in the environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://specterops.io/blog/2026/09/08/token-analysis-and-tracking-system-tats

Content Categories: Based on the analysis, this content was categorized under "Azure Pentesting > Az - Basic Information > Az - Tokens & Public Applications, with cross-references to Az - EntraID Privesc > Conditional Access Policies & MFA Bypass and Az - Lateral Movement (Cloud - On-Prem) > Pass the Cookie / Primary Refresh Token (PRT)".

Repository Maintenance:

• MD Files Formatting: 814 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0