cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customerā€™s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
904 stars 77 forks source link

Goosey Honk | Error on nextLink retrieval 'token_type' #44

Closed ghost closed 1 year ago

ghost commented 1 year ago

šŸ› Summary

After successful authentication, there is a problem with goosey honk. I get the .json files but after that the program does an infinite loop with the following error: 2023-06-21 08:11:13,235 - utils - ERROR - Error on nextLink retrieval ff4a981eaf06f32016669eed1826a88a_1026: 'token_type' (utils.py:302)

In error.log, there is the following error: goosey.azure_ad_datadumper ERROR Error on nextLink retrieval 183a986e80f6d6abc350c6b3e161d9f8_1045: 'token_type'

To reproduce

I normally have the latest version of the tool -- UntitledGooseTool v1.2.1.

In the .conf file, I only show the modified fields, everything else is defined by default :

[config]
tenant=<tenant-id>
us_government=False
mde_gcc=False
mde_gcc_high=False
exo_us_government=False
subscriptionid=All
m365=True

[azuread]
applications=True
azuread_audit=True
azuread_provisioning=True
conditional_access=True
devices=True
directory_roles=True
groups=True
identity_provider=True
organization=True
policies=True
risk_detections=True
risky_objects=True
security=True
service_principals=True
signins_adfs=True
signins_msi=True
signins_rt=True
signins_sp=True
summaries=True
users=True
  1. goosey auth
  2. goosey honk

Any helpful log output or screenshots

error.log : goosey.azure_ad_datadumper ERROR Error on nextLink retrieval 183a986e80f6d6abc350c6b3e161d9f8_1045: 'token_type'

error python-error

Thanks in advance!

victoriawallace-cisa commented 1 year ago

@antoinevirgos Is this issue still present in goose v1.2.2?

ghost commented 1 year ago

I installed goose v1.2.3 and ran the goosey honk command. The error no longer appears at all and everything works. Thanks