Identity Attack Simulation & Security Testing
AuthStrike is an identity and authentication security testing tool for authorized security assessments, controlled simulations, security research, and education only.
It helps security teams test Microsoft Entra attack paths such as device-code authentication, token handling, device registration, Microsoft Graph/Outlook access, and supported token-refresh flows.
- Open the operator portal at
/admin. - Sign in and create a new operation.
- Select the Microsoft client/profile you want to test.
- AuthStrike generates the campaign URLs for the operation.
- Send the appropriate URL to an authorized test participant.
- The participant completes the Microsoft device sign-in flow.
- AuthStrike captures and monitors the resulting authentication state.
- Use the operator portal to inspect tokens, accounts, refresh results, Outlook/Graph access, and other supported test workflows.
Public campaign URLs stay separate from the protected operator portal.
- Python 3.10+
- pip
- An authorized Microsoft Entra test tenant
- Dedicated test users/devices for the scenarios being tested
- Appropriate Microsoft client/application configuration and permissions
- HTTPS for production deployments
Create the environment file:
cp .env.example .envSet the required values:
FLASK_SECRET_KEY=...
AUTHSTRIKE_ADMIN_USERNAME=admin
AUTHSTRIKE_ADMIN_PASSWORD_HASH=...
AUTHSTRIKE_HTTPS=true
STORE_RAW_TOKENS=false
FLASK_DEBUG=false
Generate a secret:
python3 -c "import secrets; print(secrets.token_urlsafe(48))"Generate the administrator password hash:
python3 scripts/create_password_hash.pyKeep .env private. Raw token persistence is disabled by default.
Create the virtual environment and install dependencies:
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python3 app.pyOpen:
http://127.0.0.1:5000/admin
For direct HTTP testing:
AUTHSTRIKE_HTTPS=false
Open /admin and sign in with the administrator account.
Open New operation, select the client/profile for the exercise, and create the operation.
The operation page provides the campaign URLs after generation.
Choose the appropriate campaign URL for the authorized exercise and send it to the authorized test participant.
Current public campaign paths include:
/validation
/outlook-simulation
/adobe-simulation
The participant follows the device-code instructions and completes the Microsoft sign-in.
The operator can keep the operation page open to monitor the authentication result.
After a successful authentication, open Tokens to review the active token records.
Use the selector to choose a token. Token details are loaded from the server-side MSAL cache.
Open Accounts to review accounts recovered from successful operations and inspect the Microsoft Graph /me profile.
Open Outlook validation, select a successful operation, and test the available Microsoft Graph / Outlook access.
When the token has the required permissions, the mailbox view can be used to inspect and interact with mail available to the authorized test account.
Open Refresh, select the operation/client combination you want to test, and request the supported silent acquisition/refresh flow.
Refresh results are stored against the operation and can be reviewed from the token and refresh workflows.
Open Device registration and select an eligible Microsoft Authentication Broker operation.
The page provides the supported ROADtools commands for the authorized lab workflow.
Open Azure CLI commands to select an eligible access token and review the read-only commands for Entra users and groups.
The commands are intended for authorized proof-of-concept testing and should be treated as sensitive because they contain an access token.
Open History to review recent operations, filter/search the list, and open individual operations.
Use the workspace reset action when you intentionally want to clear AuthStrike's stored test state.
Do this only when you no longer need the existing operation, token, and cache data.
Create .env from .env.example, then:
cd Docker
docker compose up --build -dOpen:
http://127.0.0.1:5000/admin
The Docker runtime volume stores shared application state and operation MSAL caches. Do not remove it unless you intentionally want to reset that state.
To stop the deployment:
docker compose downThe repository includes a deployment script:
cd scripts/
chmod +x deploy.sh
./deploy.shThe script asks for the Azure resource group and Web App name, packages the application, deploys it, and restarts the App Service.
Use HTTPS in production.
After deployment, open:
https://<your-app-service-hostname>/admin
Keep the App Service runtime configuration and startup command aligned with the included deployment script. The public campaign URLs do not require operator authentication.
AuthStrike uses MSAL's token cache for silent acquisition and supported refresh flows. Cross-client behavior depends on the client, cached authentication state, and Microsoft Entra authorization.
The following paths can be used as high-confidence detection indicators for an AuthStrike exercise.
| Indicator | Description | Priority |
|---|---|---|
/validation |
Public simulation URL | High |
/outlook-simulation |
Public simulation URL | High |
/adobe-simulation |
Public simulation URL | High |
runtime/caches/operation_*.bin |
Server-side artifact | High |
- Treat access tokens, ID tokens, MSAL caches, and mailbox data as sensitive.
- Raw token persistence is disabled by default.
- Use HTTPS for production deployments.
- Use AuthStrike only in environments and accounts where you have explicit authorization.
- Review retention and cleanup settings before using the tool for long-running environments.
GNU General Public License v3.0 (GPLv3)
Contributions are welcome. Open an issue or submit a pull request with improvements, bug fixes, or documentation updates. If you add features that change token handling or storage, document the changes and security implications.