TokenLook ‐ TokenExtract

Introduction

Extraction from Outlook app memory

• The method of extracting JWT tokens from outlook app memory has already been highlighted before https://mrd0x.com/stealing-tokens-from-office-applications/
• For our purpose, we created a simple C# program that uses legitimate Process Dump binary from Microsoft in combination with custom parsing to extract tokens from the Outlook process memory

extract_noexfil.cs

• This version of the program is a simple extractor, that works in following steps: *