Announcements & Evolving ROADtools for Entra ID Recon & Tokens | Dirk-jan Mollema
Industry experts analyze emerging threats surrounding Announcements & Evolving ROADtools for Entra ID Recon & Tokens | Dirk-jan Mollema.
Summary
ROADtools Overview
Dirk-jan Mollema presents ROADtools for Microsoft Entra ID enumeration and token operations. Released in 2020, the open-source toolkit centers on ROADlib authentication flows, ROADrecon for tenant reconnaissance, and ROADtx for token exchange.
Red and Blue Team Utility
ROADrecon runs from low-privilege accounts to enumerate tenant data useful for both red-team mapping and blue-team analysis when the Azure portal hides relationships. ROADtx handles refresh tokens, access tokens, cookies, and memory-extracted credentials.
Azure AD Graph Deprecation
The tool relies on graph.windows.net's Azure AD Graph API, including an internal version exposing conditional access policies without privileged roles. Microsoft is deprecating this API in favor of the more restricted Microsoft Graph, which limits visibility into internal Entra properties.
Privilege Analysis Demo
Mollema previews detecting hidden global-admin privileges through user "Bob," demonstrating how ROADrecon analysis surfaces authorization paths not obvious in standard portal views.
Related talks
Wild West Hackin' Fest·14 min
Jonathan Rogers
Analysts investigate attack surfaces and defenses concerning Getting Started in Entra ID Security | Jonathan Rogers.
FIRST·42 min
Engineers explore architecture and security mechanisms for Seeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks.
TROOPERS IT Security Conference·52 min
Analysts investigate attack surfaces and defenses concerning Delete Is Easy - Recovery Is Not: The Reality of Entra ID Backup & Restore.