# GhostLoot part 2: the Microsoft cookie mess, the inbox, and the Google wall

Part 1 got the loot out of Evilginx's session list. Part 2 is what I learned the hard way after that: which Microsoft cookie is actually money, which "TTL" is a fiction, how the panel had to stop being a spreadsheet, and why a stock Google phishlet will waste your week.

Evilginx 3.3.0 Community. GhostLoot 1.6.1. Still authorized work only. Still a read-only viewer.

## The Tuesday that looked like a broken tool

Smoke-test. Personal Microsoft account into an o365-shaped phishlet. Capture comes back. I open the cookies. `MSPAuth: Disabled`. Or worse, a stub that looks like a session until you stare at it.

First thought: GhostLoot is wrong. It wasn't. Microsoft never issued a reusable session on the path I was on.

"Microsoft login" is two IdPs sharing a brand.

## Entra is not MSA

**Entra ID** is work and school. Host: `login.microsoftonline.com`. The cookies that matter are `ESTSAUTH` (non-persistent: about 24 hours or until the browser closes) and `ESTSAUTHPERSISTENT` (persistent SSO: up to 90 days of inactivity, rolling, until revoked). Replay means import on `https://login.microsoftonline.com`, then open `https://www.office.com`. Outlook on the web is Entra territory. A personal `MSAAUTHP` will not SSO you into it.

**MSA** is personal Microsoft accounts — including a Gmail you registered as a Microsoft account, including passwordless Authenticator-only. Host: `login.live.com`. For passwordless, the cookie that matters is `__Host-MSAAUTHP`. It persists across browser close. Microsoft does not publish a Max-Age. Anyone quoting "one year" is guessing. `__Host-MSAAUTH=11` is a deleted stub, not loot. Password MSA can show `__Host-MSAAUTH` with a real long value; that one is not persistent.

Replay for MSA: import on `https://login.live.com`, then `https://account.microsoft.com`. Avoid `https://outlook.live.com` — you do not get SSO from `MSAAUTHP` there.

Throw a personal account at an Entra-wired phishlet and Microsoft quietly routes you into the consumer stack. Different hosts. Different cookies. The proxy collects flow junk. The session never closes cleanly. You get `Disabled`. That is a coverage problem, not "AiTM fails on personal accounts."

I ended up with one `microsoft.yaml` covering both stacks, redirect-on-capture after loot. Separate o365-only files for personal accounts were the wrong shape.

## The stock Evilginx completion lie

Community Evilginx has a footgun: `AllCookieAuthTokensCaptured` wants **all** listed tokens.

A live MSA capture will never carry `ESTSAUTH`. A live Entra capture will never carry `MSAAUTHP`. So the session never "completes," even when you are holding the one cookie that actually replays.

The patch that made ops sane: treat the session as captured when **any** required non-junk token is present.

Junk that must never count as loot: empty, `Disabled`, `estsfd`, `11`, length ≤ 2.

## The name-fold bug that refused to match

Go lowercases cookie names. `strings.ToLower("__Host-MSAAUTHP")` becomes `__host-msaauthp` — two a's in `msaa`.

I wrote a switch case as `__host-msauthp` — one a. It never matched. The panel kept calling good MSA loot invalid while I stared at a cookie that was sitting right there.

Tests that earned their keep: PasswordlessMSA, PasswordMSA, TestMSCookieNameFold. If you fold names, count the a's.

## The TTL lie

Evilginx's `CookieToken` does not store `Set-Cookie` Expires. So any countdown you invent in a UI is fan fiction.

GhostLoot's panel only shows kinds it can defend: `parsed` (JWT `exp` when the cookie actually is a JWT), `idle90d`, `idle24h`, `session`, `persistent`, `unknown`. No `now+1y`. No fake 89-day ticker.

TTL lives in the inspector as context. The scan signal is freshness: captures under fifteen minutes get a copper highlight; default sort is recency. When you are juggling Telegram alerts, "is this still warm" beats "is this theoretically ninety days."

## Turning the panel into an inbox

After part 1 I kept bolting columns. Then I ripped them out. Then I put some back. The only job that mattered: Telegram ping → about twenty seconds → replay or bounce → notes. Manual. No auto-replay. GhostLoot still never writes phishlets and never talks to live Evilginx — copy `~/.evilginx/data.db` (buntdb), parse, delete the copy. Default listen `127.0.0.1:8090`. One Go binary, `index.html` embedded with `go:embed`. Version in production: 1.6.1.

The panel is an inbox now.

Tabs: Inbox, Captures, Lures, Settings. Dashboard collapsed into a period strip on Lures — not a place you live. Keyboard: `1–4`, `j`/`k`, `c` copy cookies, `b` brief, `h` Cookie header, `u` done, `e` bounced, `?`.

Inbox columns that survived: account + status tag, loot type (Entra ID / Microsoft account), password blurred, from (CC · city · UA), expires (honest label), when (relative + absolute). Geo is optional via ip-api.com with a local JSON cache; `-nogeo` turns it off. Still never send lure URLs to Safe Browsing, VirusTotal, or urlscan.

Statuses are three: `open`, `bounced`, `done`. I tried `copied` / `replayed`. They confused me mid-op, so they folded back into `open`. Bounce reasons persist: CA / IP mismatch / UA / token dead.

Replay inspector is a checklist, not a pretty card:

1. VPN/exit — country · city · AS… and Copy UA  
2. Import on `login.microsoftonline.com` or `login.live.com`  
3. Then open `office.com` / `account.microsoft.com`

One primary **Copy cookies**. Accept-Language (suggested from country, not captured), Cookie header, long briefing — behind More.

Telegram on the wire is Spanish and thin: `#46 · hace 40s`, type, persist, user (unless minimal mode), country, UA, import/then/avoid. Never the cookie. Never the password. Minimal mode drops account and IP when that alert leaves your perimeter.

## One command from the laptop

`ghostloot` on the laptop: if `localhost:8090` is down, it builds `ssh -L 8090:127.0.0.1:8090` with ControlMaster. It does not `pkill` ssh. `ghostloot down` stops the panel systemd unit and closes that tunnel. `ghostloot console` attaches the Evilginx tmux — and yes, root and ubuntu use different sockets (`/tmp/tmux-0` vs `/tmp/tmux-1000`); the CLI finds the session owner instead of guessing.

Server side: systemd unit `ghostloot` on `127.0.0.1:8090`, config `/etc/ghostloot.conf`. Laptop config under `~/.ghostloot/`. `sudo ./install.sh` hunts `data.db`, the Evilginx binary, and a free loopback port in `8090–8094`.

Bugs that only show up when you actually run it:

- Template called `.size` on an Array (`ips.size` → undefined IPs).  
- API said `update` / `landing`; UI expected `update_time` / `landing_url`.  
- `go.mod` wanted 1.24; VPS had 1.22 — lowered the module.  
- Copying the binary onto itself while it was running → `ETXTBSY`. Kill whatever is on 8090 first. Do not `pkill` the SSH tunnel that is keeping you in.

## The Google wall

I will say this once, without a tutorial.

Public `google.yaml` files (the usual Community collections, `min_ver: 2.3.0` and friends) will load. Login becomes WebLiteSignIn / `/v3/signin/identifier`. Next is a JS button (`identifierNext`). `bgresponse` defaults toward `js_disabled`. Botguard / reCAPTCHA Enterprise sits on the path. Force a POST with the email and you still land on `/v3/signin/rejected?...&rhlk=js`.

Hostname rewrite, extra `proxy_hosts`, Cloudflare Origin in front of the lure — none of that mints Botguard. Community cannot do Google properly. Pro uses Evilpuppet. YAML will not save you. I am not publishing a bypass.

Cloudflare in front of a lure hides origin in DNS. New hostnames need origin certs. Let's Encrypt HTTP-01 against orange-cloud returns 403. Missing origin cert and the visitor gets 525. That is ops, not a Google breakthrough.

## What actually stops AiTM

Password plus SMS, OTP, push, or emailed code does not. You capture after the second factor is done.

Phishing-resistant MFA does: FIDO2, passkeys, Windows Hello for Business, bound to the real origin. The browser will not hand that credential to your look-alike domain. Nothing to steal. If a tenant enforces that, the run dies at the door — write it up as a strength.

If the tenant has no 2FA at all, that is the tenant. It is not your phishlet "skipping" MFA.

## OPSEC, still boring on purpose

Bind loopback, tunnel in. Off-localhost without `-user`/`-pass` refuses to start. CSRF origin check on POSTs. State files `0600`. Do not park a second web app (GoPhish and friends) on `0.0.0.0:8080` on the same box. Mail from a warmed mailbox, not the proxy IP. Replay from a VPN in the victim's country with a cloned UA — not from the VPS. Optional geo is fine; shipping lure URLs to Google Safe Browsing is how infra dies.

## Grab it

GhostLoot is MIT: [github.com/marcocarolasec/ghostloot](https://github.com/marcocarolasec/ghostloot)

Read-only viewer for a `data.db` you already have, on an engagement you are cleared to run. No Evilginx in the repo. No phishlets. No auto-replay.

If you have run Community Evilginx against Microsoft in 2026: did the Entra vs MSA split burn you too, or has a CE Google Next flow ever actually completed for you?