Is this a potential spoofing exploit?

Copper Contributor
  • Install OfficeDevPnP.Core

  • Create a ClientContext with AuthenticationManager.GetWebLoginClientContext method

  • Get CookieCollection from ExecutingWebRequest event as below CookieCollection cookies = null; clientContext.ExecutingWebRequest += delegate (object sender, WebRequestEventArgs e) { cookies = e.WebRequestExecutor.WebRequest.CookieContainer.GetCookies(new Uri(siteurl)); };

  • Save Cookie object from CookieCollection as text file.

  • Copy the Cookie objects to a different machine

  • Load Cookie objects to CookieContainer as below clientContext.ExecutingWebRequest += delegate (object sender, WebRequestEventArgs e) { e.WebRequestExecutor.WebRequest.CookieContainer = new CookieContainer(); foreach (Cookie cookie in cookies) { e.WebRequestExecutor.WebRequest.CookieContainer.Add(cookie); } };

  • User can access the same Sharepoint site without having to login and this login session will not show up in Azure Sign in history list.

0 Replies