Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
TokenFlare — Serverless AITM Simulation Framework for Entra ID and M365 | Kitploit
Tools/GitHubGitHub/jumpseclabs/tokenflare
IDS/IPS EvasionWeb Application ExploitationPhishingPenetration TestingCloud SecurityCommand and ControlSocial EngineeringAuthenticationRed Teaming
GitHubjumpseclabs/tokenflare

TokenFlare

Serverless AITM Simulation Framework for Entra ID and M365

2423748 months agoReviewed by Kitploit
View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

TokenFlare

Serverless AITM Phishing Simulation Framework for Entra ID / M365

TokenFlare

Features

  • Lean: Core logic (in src/worker.js only ~530 lines of JavaScript).
  • Modular: Supports a number of OAuth flows, with Intune Conditional Access bypass support out of the box
  • Easily tweaked: Set up client branding, URL structure (custom lure path and parameter), final redirect after completing auth, and more, with the semi-interactive tokenflare configure campaign subcommand.
  • Local or remote deployment: Supports getting SSL certs with Certbot for you, or deployment to CF directly.
  • Built in OpSec: bot and scraper blocking, your campaign wouldn't be burnt in 10 minutes.
  • Fast: get working, production ready infra within minutes.

Companion blog post: Link

Prerequisites

  • Python 3.7+
  • Node.js 20+ with Wrangler CLI. On Linux, we recommend NodeSource:
    root@kitploit:~
    curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt-get install -y nodejs
npm install -g wrangler
Download Tool
  • CloudFlare account with API Token (for remote deployment):
    1. CloudFlare Dashboard → Create Token
    2. Use template "Edit Cloudflare Workers" → Include your account under Account Resources → [optional] IP filtering
  • [Optional] Certbot for local SSL: sudo apt install certbot

    • Note: Developed and tested on an Ubuntu VPS hosted on a public cloud. Running on localhost is possible but not recommended (for reasons such as port forwarding, DNS record pointing to you, etc)

    Quick Start

    root@kitploit:~
    # 1. Initialise
python3 tokenflare.py init yourdomain.com

# 2. Configure campaign (interactive wizard)
python3 tokenflare.py configure campaign

# 2.5. Get valid SSL certificate for the domain pointing to your VPS
sudo python3 tokenflare.py configure ssl

# 3. Deploy locally for testing
sudo python3 tokenflare.py deploy local


# 4. Deploy to CloudFlare
python3 tokenflare.py configure cf
python3 tokenflare.py deploy remote

# 5. Troubleshooting
# change some settings in wrangler.toml, src/worker.js, or with tokenflare configure, then
python3 tokenflare.py deploy local #or
python3 tokenflare.py deploy remote

    Commands

    CommandDescription
    init <domain>Initialise project for domain
    configure campaignInteractive campaign setup
    configure cfCloudFlare credentials
    configure sslSSL certificate setup
    deploy localLocal HTTPS proxy
    deploy remoteDeploy to CloudFlare
    statusConfiguration overview
    status --get-lure-urlShow lure URLs

    Captured Credentials

    Credentials, auth codes, and session cookies are sent to your configured webhook. Supports Slack, Discord, Teams, and generic webhooks (auto-detected from URL).

    Configure during configure campaign or set WEBHOOK_URL in wrangler.toml.

    Local credential saving in files is not implemented due to serverless nature of Workers. If you'd like to add log(creds); in src/worker.js, beware that CF might redact JWTs, cookies or creds captured. Having a working webhook is the most reliable method in our experience.

    Easy IoCs for blue teams

    root@kitploit:~
    Header:     X-TokenFlare: Authorised-Security-Testing
User-Agent: TokenFlare/1.0 For_Authorised_Testing_Only

    Acknowledgements

    Many Thanks to:

    • TE - for helping, debugging, teaching me a ton and otherwise being an awesome human being.
    • Dave @Cyb3rC3lt - for creating our v1 internal prod Worker.
    • Zolderio - for creating the prototype PoC Worker that started it all.
    • ChoiSG - for flagging Global API Key support.

    Disclaimer

    FOR AUTHORISED SECURITY TESTING ONLY

    Unauthorised use against systems you do not own or have permission to test is illegal.

    Using Cloudflare's services to penetration test a third party might go against some of their T&C's. Don't write to us if your prod CF account was banned - consider yourself warned.

    License

    See LICENSE file.