TATS — Token Analysis and Tracking System

Track OAuth 2.0, OIDC, and Microsoft Entra ID tokens across captured network traffic. Ingests Burp Suite XML exports, mitmproxy flow files, or live Chrome DevTools Protocol streams into a single SQLite database, then serves an interactive web dashboard for filtering tokens, walking exchanges, spotting risky scopes, exporting tokens for replay, and visualising token lifecycles as Mermaid graphs.

Status: TATS is stable for personal / engagement use. Optimised for the Microsoft 365 / Entra ecosystem (FOCI, BroCI/NAA, ESTSAUTH session cookies, entrascopes.com enrichment) but works against any standard-ish OAuth/OIDC traffic.

---

Why it exists

When you proxy a long Microsoft 365 or Azure session through Burp / mitmproxy the resulting capture is enormous and most tools either:

• Only show one token at a time (Burp's JWT extension), or
• Don't follow Microsoft's OAuth dialect (FOCI, BroCI, ESTSAUTH cookies), or
• Don't track WebSocket frames, where Teams / Skype / SignalR send tokens, or
• Don't tell you which tokens are still valid right now.

This tool extracts every observed access / refresh / id token, fingerprints them so it can correlate the same token across sources, decodes JWT claims, resolves Microsoft client / resource GUIDs against entrascopes.com, and renders the whole picture as a single dashboard — including a refresh-token chain view that follows FOCI cross-app exchanges and BroCI nested-app token issuance.

This project is intended primarily for research and education purposes but provides options such as command preview and token export features that can support some offensive tooling.

---

Features

Core

• Three ingest sources in one tool:
  • ingest — Burp Suite "Save items" XML export
  • mitm — mitmproxy .mitm flow file (HTTP and WebSocket frames)
  • cdp — live attach to Chrome / Edge via DevTools Protocol (real-time, captures TLS-decrypted HTTP and WebSocket frames without a proxy CA; tracks every existing tab AND every tab opened during the run via browser-level auto-attach)
• One canonical SQLite store the dashboard reads from. Each ingest pass can be run with --append to merge into an existing database; tokens are upserted (uses count + observed lifetime accumulate), events and exchanges are appended, and the row's source_tag records every pass that has seen the token.
• Live web dashboard served by a stdlib HTTP server. Polls the database every 5 seconds and re-renders when the underlying data changes — so a running CDP capture updates the dashboard in near real-time.
• No proprietary dependencies for the core paths. Burp ingest, the database layer, the web UI, and CDP attach are all stdlib only. The mitmproxy import is the one optional dep (pip install mitmproxy).

Token classification & enrichment

• OAuth body keys (access_token, refresh_token, id_token) and cookie-name heuristics drive the token type.
• Microsoft session cookies (ESTSAUTH, ESTSAUTHPERSISTENT, ESTSAUTHLIGHT, SignInStateCookie) are explicitly recognised as refresh-equivalent tokens (they would otherwise be misclassified by the generic "auth" cookie hint).
• JWT claims (header + payload) decoded and stored verbatim — never truncated.
• Microsoft FOCI (Family of Client IDs) detected via the foci field in token-endpoint responses.
• Microsoft BroCI / Nested App Authentication detected via brk_client_id, brk_redirect_uri, and brk-<guid>:// redirect schemes in the request body.
• Optional --enrich flag fetches firstpartyscopes.json and resources.json from https://entrascopes.com/ and resolves appid / azp / aud GUIDs into friendly names with clickable links.

Dashboard cards

• Summary tiles — token counts, hosts, exchanges (with FOCI / BroCI call-outs), and an enrichment status indicator.
• Users — token bucketing by upn / preferred_username / unique_name / email / name, falling back to sub@iss or oid, and surfacing app-only and unknown-identity buckets separately. Each identity row shows a captures badge when the user appears in ≥2 source_tags (cross-capture survival, the headline --append research signal) plus a first_seen → last_seen span and a timeline button that highlights every token for that user on the Sequence-diagram tab.
• Token validity — counts of currently-valid vs expired access tokens, refresh-token expiry status (with "unknown expiry" for opaque tokens), and a top-3 "next to expire" list with a 30-second auto-refresh.
• Clients — every distinct app (appid / azp / form-body client_id / brk_client_id / brk_nested_id) that's appeared in exchanges, with FOCI / brokerable / broker / nested badges.
• Audiences — every aud claim observed, resolved to entrascopes resource names where possible.
• Tenants — distinct tid values with token / user / app counts.
• Hosts — events, distinct bearer recipients, distinct issuers, and exchange counts per host.
• Privileged scopes & roles — checks each token's scp / scope / roles against a curated watchlist of high-impact Microsoft Graph permissions and Azure resource scopes.
• Audience / host mismatches — flags every (token, host) pair where the token was used at a host that disagrees with its aud claim (suggests credential leak or misuse).
• Auth methods (amr) — pwd / mfa / pop / smartcard distribution.
• Security features — flags Continuous Access Evaluation (xms_cc=CP1), proof-of-possession binding (cnf claim, with shared-kid detection across audiences), step-up auth requirements (acrs), and the acr authentication-context level. Each row is clickable and filters the Tokens tab to only the tokens that carry that marker.
• Refresh-token chains — walks exchange edges to identify rotation lineages, longest chain length, and idle refresh tokens. Each chain shows a Δ scopes column (added / removed scopes across hops, with the full per-hop diff on hover) and flags chains where an added scope matches the privileged-scope watchlist with a ⚠ priv badge — the FOCI / BroCI-style privilege-expansion research signal.
• Sources — per-source_tag token counts so you can see how many rows came from each ingest pass.

Tokens / Exchanges tabs

• Click a column header to sort.
• Multi-select checkboxes drive a toolbar:
  • Highlight in Graph — yellow accent on the selected nodes.
  • Isolate in Graph — redraw the diagram showing only the selected tokens plus the tokens they exchange with.
  • Show in Sequence — focused sequence diagram for the selected token(s).
• Click a row to expand an inline panel with full JWT header + payload (raw JSON), all events, related exchanges, replay-ready export buttons (raw / Bearer / curl / JSON / roadtx token cache), and a command-preview block with copy-paste snippets for roadtx describe, roadtx auth, curl, Python requests, and PowerShell Invoke-RestMethod.
• Filters: type chips (access / refresh / id / unknown), format chips (jwt / opaque), used / unused dropdown, validity dropdown (any / valid / expired / unknown expiry), FOCI-only, BroCI-only, has-app-match, has-resource-match, plus a free-text search across fp / sample / claims / host / app / resource / source_tag / user.
• CSV / JSON export of the currently filtered + sorted rows.
• URL hash persistence — the active tab and every filter state is serialised to the URL hash, so links to specific filtered views are shareable.