Translated ['', 'src/pentesting-cloud/azure-security/az-basic-informatio

src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md

@@ -4,97 +4,170 @@
 
 ## Taarifa za Msingi
 
-Entra ID ni jukwaa la Microsoft la identity na access management (IAM) mliopo kwenye cloud, likiwa mfumo wa msingi wa uthibitishaji na uidhinishaji kwa huduma kama Microsoft 365 na Azure Resource Manager. Azure AD inaendesha OAuth 2.0 authorization framework na protocol ya OpenID Connect (OIDC) kwa kusimamia ufikiaji wa rasilimali.
+Entra ID ni jukwaa la Microsoft la utambulisho na usimamizi wa upatikanaji (IAM) linalotegemea wingu, likihudumu kama mfumo wa msingi wa uthibitisho na uidhinishaji kwa huduma kama Microsoft 365 na Azure Resource Manager. Azure AD inaetekeleza muundo wa uidhinishaji wa OAuth 2.0 na itifaki ya uthibitisho OpenID Connect (OIDC) kusimamia ufikiaji wa rasilimali.
 
 ### OAuth
 
-**Washiriki Wakuu katika OAuth 2.0:**
+**Wahusika Wakuu katika OAuth 2.0:**
 
-1. **Resource Server (RS):** Hulinda rasilimali zinazomilikiwa na resource owner.
-2. **Resource Owner (RO):** Kwa kawaida mtumiaji wa mwisho ambaye anamiliki rasilimali zilizo salama.
-3. **Client Application (CA):** Programu inayotafuta ufikiaji wa rasilimali kwa niaba ya resource owner.
-4. **Authorization Server (AS):** Hutolewa access tokens kwa client applications baada ya kuwatambua na kuwaidhinisha.
+1. **Resource Server (RS):** Linalinda rasilimali zinazomilikiwa na Resource Owner.
+2. **Resource Owner (RO):** Kawaida ni mtumiaji wa mwisho ambaye anamiliki rasilimali zilizolindwa.
+3. **Client Application (CA):** Programu inayotafuta kufikia rasilimali kwa niaba ya Resource Owner.
+4. **Authorization Server (AS):** Hutoa access tokens kwa client applications baada ya kuthibitisha na kuzipatia ruhusa.
 
-**Scopes na Idhini:**
+**Scopes na Consent:**
 
-- **Scopes:** Ruhusa za undani zilizoainishwa kwenye resource server zinazobainisha ngazi za ufikiaji.
-- **Consent:** Mchakato ambao resource owner anampa client application ruhusa za kufikia rasilimali kwa scopes maalum.
+- **Scopes:** Ruhusa maalum zilizofafanuliwa kwenye Resource Server zinazobainisha viwango vya upatikanaji.
+- **Consent:** Mchakato ambapo Resource Owner anampa Client Application ruhusa ya kufikia rasilimali kwa scopes maalum.
 
-**Muunganisho wa Microsoft 365:**
+**Microsoft 365 Integration:**
 
-- Microsoft 365 inatumia Azure AD kwa IAM na inajumuisha programu nyingi za OAuth za "first-party".
-- Programu hizi zimetumika kwa karibu na mara nyingi zina uhusiano wa huduma unategemeana.
-- Ili kurahisisha uzoefu wa mtumiaji na kudumisha utendakazi, Microsoft inatoa "implied consent" au "pre-consent" kwa programu hizi za first-party.
-- **Implied Consent:** Programu fulani hupata kwa kiotomatiki **ufikiaji wa scopes maalum bila idhini wazi ya mtumiaji au msimamizi**.
-- Scopes hizi zilizotanguliwa kwa kawaida hujificha kutokana na watumiaji na wasimamizi, na kufanya zioneke kidogo kwenye interfaces za kawaida za usimamizi.
+- Microsoft 365 inatumia Azure AD kwa IAM na inajumuisha programu nyingi za OAuth "first-party".
+- Programu hizi zimeunganishwa kwa kina na mara nyingi zina uhusiano wa utegemezi kati ya huduma.
+- Ili kurahisisha uzoefu wa mtumiaji na kudumisha ufanisi, Microsoft huwapa programu hizi za first-party "implied consent" au "pre-consent".
+- **Implied Consent:** Programu fulani zinapewa kwa kiotomatiki **ufikiaji wa scopes maalum bila idhini wazi ya mtumiaji au msimamizi**.
+- Scopes hizi zilizotanguliwa kwa idhini kwa kawaida zenye kufichwa kwa watumiaji na wasimamizi, na hivyo kuzifanya zioneike kidogo katika miunganisho ya kawaida ya usimamizi.
 
-**Aina za Client Application:**
+**Client Application Types:**
 
 1. **Confidential Clients:**
-- Wanamiliki credentials zao (mfano, nywila au vyeti).
-- Wanaweza **kujithibitisha kwa usalama** kwa authorization server.
+- Wanamiliki vitambulisho vyao (mfano, nywila au vyeti).
+- Wanaweza **kuji-authenticate kwa usalama** kwenye authorization server.
 2. **Public Clients:**
-- Haina credentials za kipekee.
-- Hawawezi kujithibitisha kwa usalama kwa authorization server.
-- **Athari za Usalama:** Mshambulizi anaweza kujifanya kuwa public client application anapotaka tokens, kwani hakuna njia kwa authorization server kuthibitisha uhalali wa programu.
+- Hawana vitambulisho maalum.
+- Hawawezi kuji-authenticate kwa usalama kwenye authorization server.
+- **Athari ya Usalama:** Muuaji anaweza kujifanya kuwa public client application anapoomba tokens, kwani hakuna njia kwa authorization server kuthibitisha uhalali wa programu.
 
-## Tokens za Uthibitishaji
+### ROPC / Password Grant
 
-Kuna **aina tatu za tokens** zinazotumika katika OIDC:
+Mtiririko wa OAuth2 **Resource Owner Password Credentials** (**ROPC**) unatumia `POST` ya moja kwa moja kwa `https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token` kwa `grant_type=password`, **username**, **password**, **client_id**, na **scope** iliyotakiwa. Katika Entra ID hii inavutia hasa kwa **public clients** kwa sababu muuaji anaweza kutumia tena client IDs za Microsoft first-party au client yoyote nyingine public iliyoruhusiwa bila hitaji la secret.
+```bash
+curl -X POST "https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token" \
+-H "Content-Type: application/x-www-form-urlencoded" \
+--data-urlencode "client_id=f05ff7c9-f75a-4acd-a3b5-f4b6a870245d" \
+--data-urlencode "client_info=1" \
+--data-urlencode "grant_type=password" \
+--data-urlencode "username=user@corp.com" \
+--data-urlencode "password=Password123!" \
+--data-urlencode "scope=https://graph.microsoft.com/.default"
+```
+Ikiwa taarifa za kuingia ni sahihi na mtiririko unaruhusiwa, Entra inaweza kurudisha **access tokens** na wakati mwingine **refresh tokens** ambazo zinaweza kutumika mara moja dhidi ya Microsoft Graph au rasilimali lengwa.
 
-- [**Access Tokens**](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens)**:** Client huwasilisha token hii kwa resource server ili **kupata rasilimali**. Inaweza kutumika tu kwa mchanganyiko maalum wa mtumiaji, client, na rasilimali na **haiwezi kuingiliwa ili kuharibiwa** hadi itakapofikia muda wake - yaani saa 1 kwa chaguo-msingi.
-- **ID Tokens**: Client hupokea token hii kutoka kwa authorization server. Ina taarifa za msingi kuhusu mtumiaji. Imefungwa kwa mchanganyiko maalum wa mtumiaji na client.
-- **Refresh Tokens**: Hutolewa kwa client pamoja na access token. Inatumika kupata **access na ID tokens mpya**. Imefungwa kwa mchanganyiko maalum wa mtumiaji na client na inaweza kuingiliwa. Muda wa kumalizika kwa chaguo-msingi ni **siku 90** kwa refresh tokens zisizotumika na **hakuna kumalizika kwa tokens zenye shughuli** (kwa sababu kutoka kwa refresh token inawezekana kupata refresh tokens mpya).
-- Refresh token inapaswa kuunganishwa na `aud`, kwa baadhi ya **scopes**, na kwa **tenant** na inapaswa kuweza kuzalisha access tokens kwa aud, scopes (na si zaidi) na tenant hiyo tu. Hata hivyo, hii si kawaida kwa **FOCI applications tokens**.
-- Refresh token imefichwa kwa encryption na ni Microsoft pekee inaweza kuifungua.
-- Kupata refresh token mpya hakuharibu refresh token iliyotangulia.
+### Aina za Bypass za Entra ID Sign-In Log
+
+Baadhi ya bug za kihistoria za Entra ID ziliruhusu **uthibitishaji wa nywila** au hata **utoaji kamili wa token** bila kuzalisha ingizo la kutarajiwa la **Entra ID sign-in log**. Hali hizo zilirekebishwa, lakini mbinu hizo bado ni muhimu kuelewa jinsi pipelines za auth zinaweza kushindwa kwa njia zinazoruhusu matumizi ya **tokens downstream kuonekana** wakati telemetry ya **sign-in upstream haipo**.
+
+#### 1. Endpoint ya tenant wa mgeni kwa uthibitishaji wa nywila kwa kificho
+
+Ikiwa ombi limepelekwa kwenye token endpoint ya **different tenant GUID**, Entra inaweza bado kuthibitisha kama nywila iliyotumwa ni sahihi kwa jina la mtumiaji lililotolewa kabla mtiririko unashindwa kwa sababu mtumiaji hayupo katika tenant ya kigeni hiyo. Kihistoria hili liliruhusu:
+
+- **Password spraying / credential validation** bila log ya kuingia inayolingana katika tenant ya mwathirika
+- Tofauti ya majibu inayofichua kama hatua ya nywila ilifanikiwa
+- Hakuna utoaji wa token, lakini telemetry ni ndogo kuliko ilivyo kwa kuingia kwa kushindwa kawaida
+
+#### 2. Lazimisha kushindwa baada ya nywila
+
+Ikiwa kigezo kinachotumika **baada** ya uthibitishaji wa credentials ni batili, kama `client_id` batili, muamala mzima unaweza kushindwa licha ya nywila kuwa sahihi. Kihistoria hili liliunda mtazamo wa kuingia **kwenye kushindwa** huku likificha kwamba jaribio la nywila lilifanikiwa.
+
+Mfumo wa kukumbuka ni:
+
+- **Uthibitishaji wa nywila unafanikiwa**
+- Hatua ya uthibitisho baadaye inashindwa
+- Log inaonyesha hali ya mwisho ya muamala lakini si hatua ya uthibitishaji wa nywila iliyofanikiwa
+
+#### 3. Zinduza kushindwa kwa logging kwa thamani kubwa lakini halali
+
+Aina hatari zaidi ni pale ombi linapoendelea kuwa sahihi kwa muundo, authentication inafanikiwa, **tokens are returned**, lakini baadhi ya **logged field** ni kubwa vya kutosha kuvunja logging pipeline. Mifano iliyoripotiwa ilijumuisha:
+
+- Kurudia scopes halali maelfu ya nyakati, kama `openid openid openid ...`
+- Kutoa header ya **User-Agent** ndefu mno lakini iliyokubaliwa
+
+Hii inaonyesha darasa la jumla la masuala ambapo:
+
+1. Entra inathibitisha credentials na sintaksia ya ombi
+2. Token inatolewa kwa mafanikio
+3. Logging inajaribu kuhifadhi field mbichi inayodhibitiwa na mtumiaji
+4. Uandishi wa logging unashindwa kwa sababu ya urefu au dhana za skima
+5. Mtumiaji anapata token halali bila rekodi ya sign-in inayolingana
+
+Mfano wa muundo wa kurudia scopes:
+```bash
+curl -X POST "https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token" \
+-H "Content-Type: application/x-www-form-urlencoded" \
+--data-urlencode "client_id=f05ff7c9-f75a-4acd-a3b5-f4b6a870245d" \
+--data-urlencode "client_info=1" \
+--data-urlencode "grant_type=password" \
+--data-urlencode "username=user@corp.com" \
+--data-urlencode "password=Password123!" \
+--data-urlencode "scope=$(for num in {1..10000}; do echo -n 'openid '; done)"
+```
+#### Hunting / defensive note
+
+Usidhani kwamba kila matumizi ya tokeni halali yatakuwa na tukio la Entra sign-in event linalolingana. Unapochunguza shughuli za Graph za kushukiwa, landanisha:
+
+- **Non-interactive sign-in logs**
+- **Graph Activity Logs**
+- **IP address**, **user/object ID**, **session/correlation identifiers**, na **time windows**
+
+Njia moja ya uhalisia ya kiutendaji ni kuweka mafanikio yaliyoshukiwa yasiyoonekana kati ya majaribio mawili ya kuingia yaliyoshindikana kisha kuthibitisha kama mfululizo unaotarajiwa `Failed -> Successful -> Failed` unakosa tukio la katikati baada ya ucheleweshaji wa ingesti. Ikiwa kuna shughuli za Graph za downstream lakini logi ya sign-in haipo, chukulia kama uwezekano wa **sign-in logging gap** au hali ya **token replay**.
+
+## Authentication Tokens
+
+Kuna **aina tatu za tokeni** zinazotumika katika OIDC:
+
+- [**Access Tokens**](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens)**:** Client huwasilisha tokeni hii kwa resource server ili **access resources**. Inaweza kutumika tu kwa mchanganyiko maalum wa user, client, na resource na **haiwezi kufutwa** hadi ipate expiry - yaani saa 1 kwa default.
+- **ID Tokens**: Client inapokea tokeni hii kutoka kwa authorization server. Inabeba taarifa za msingi kuhusu user. Imefungamana na mchanganyiko maalum wa user na client.
+- **Refresh Tokens**: Zinatolewa kwa client pamoja na access token. Zinatumika kupata **access na ID tokens** mpya. Zimefungamana na mchanganyiko maalum wa user na client na zinaweza kufutwa. Default expiry ni **siku 90** kwa refresh tokens zisizotumika na **hakuna expiry kwa tokens zilizo hai** (kutokana na refresh token inawezekana kupata refresh tokens mpya).
+- Refresh token inapaswa kuunganishwa na **`aud`**, kwa baadhi ya **scopes**, na kwa **tenant** na inapaswa tu kuweza kuzalisha access tokens kwa aud hiyo, scopes (na sio zaidi) na tenant. Hata hivyo, hili si hali kwa **FOCI applications tokens**.
+- Refresh token imeencrypted na ni Microsoft pekee anayemuweza ku-decrypt.
+- Kupata refresh token mpya hakufuti refresh token ya awali.
 
 > [!WARNING]
-> Taarifa za **conditional access** **zimehifadhiwa** ndani ya **JWT**. Hivyo, ikiwa utaiomba **token kutoka kwa anwani ya IP iliyoruhusiwa**, IP hiyo ita **hifadhiwa** ndani ya token na basi unaweza kutumia token hiyo kutoka kwa **IP isioruhusiwa kufikia rasilimali**.
+> Information for **conditional access** ime**stored** ndani ya **JWT**. Kwa hivyo, ikiwa utaomba **token kutoka kwa allowed IP address**, IP hiyo itawekwa ndani ya tokeni na kisha utaweza kutumia tokeni hiyo kutoka kwa **non-allowed IP to access the resources**.
 
 ### Access Tokens "aud"
 
-Uwanja unaoonyeshwa katika "aud" ni **resource server** (programu) inayotumika kufanya login.
+Sehemu iliyoonyeshwa kwenye uwanja wa "aud" ni **resource server** (the application) inayotumika kufanya login.
 
-Amri `az account get-access-token --resource-type [...]` inaunga mkono aina zifuatazo na kila moja itauongeza "aud" maalum katika access token inayotokana:
+Amri `az account get-access-token --resource-type [...]` inaunga mkono aina zifuatazo na kila moja itauongezea "aud" maalum katika access token inayotokana:
 
 > [!CAUTION]
-> Kumbuka kuwa yafuatayo ni tu API zinazoungiwa mkono na `az account get-access-token` lakini kuna zaidi.
+> Kumbuka kwamba yafuatayo ni API tu zinazoungwa mkono na `az account get-access-token` lakini kuna zaidi.
 
 <details>
 
 <summary>aud examples</summary>
 
-- **aad-graph (Azure Active Directory Graph API)**: Inatumiwa kufikia legacy Azure AD Graph API (deprecated), ambayo inaruhusu programu kusoma na kuandika data ya directory katika Azure Active Directory (Azure AD).
+- **aad-graph (Azure Active Directory Graph API)**: Inatumika kufikia Azure AD Graph API ya zamani (deprecated), ambayo inaruhusu applications kusoma na kuandika data za directory katika Azure Active Directory (Azure AD).
 - `https://graph.windows.net/`
 
-* **arm (Azure Resource Manager)**: Inatumiwa kusimamia rasilimali za Azure kupitia Azure Resource Manager API. Hii ni pamoja na shughuli kama kuunda, kusasisha, na kufuta rasilimali kama virtual machines, storage accounts, na zaidi.
+* **arm (Azure Resource Manager)**: Inatumika kusimamia Azure resources kupitia Azure Resource Manager API. Hii inajumuisha operesheni kama kuunda, kusasisha, na kufuta resources kama virtual machines, storage accounts, na zaidi.
 - `https://management.core.windows.net/ or https://management.azure.com/`
 
-- **batch (Azure Batch Services)**: Inatumiwa kufikia Azure Batch, huduma inayowezesha programu za kiwango kikubwa za parallel na high-performance computing kwa ufanisi kwenye cloud.
+- **batch (Azure Batch Services)**: Inatumika kufikia Azure Batch, huduma inayowezesha programu za parallel na high-performance computing kwa kiwango kikubwa kwa ufanisi kwenye cloud.
 - `https://batch.core.windows.net/`
 
-* **data-lake (Azure Data Lake Storage)**: Inatumiwa kuingiliana na Azure Data Lake Storage Gen1, ambayo ni huduma ya kuhifadhi data inayoweza kupanuka na uchambuzi.
+* **data-lake (Azure Data Lake Storage)**: Inatumika kuingiliana na Azure Data Lake Storage Gen1, ambayo ni huduma ya kuhifadhi data inayoweza kupanuka na kwa uchambuzi.
 - `https://datalake.azure.net/`
 
-- **media (Azure Media Services)**: Inatumiwa kufikia Azure Media Services, zinazotoa usindikaji wa media na utoaji wa video na audio ulio kwenye cloud.
+- **media (Azure Media Services)**: Inatumika kufikia Azure Media Services, zinazo toa huduma za cloud-based media processing na delivery kwa video na audio content.
 - `https://rest.media.azure.net`
 
-* **ms-graph (Microsoft Graph API)**: Inatumiwa kufikia Microsoft Graph API, endpoint iliyounganishwa kwa data za huduma za Microsoft 365. Inakuwezesha kupata data na maarifa kutoka kwa huduma kama Azure AD, Office 365, Enterprise Mobility, na huduma za Usalama.
+* **ms-graph (Microsoft Graph API)**: Inatumika kufikia Microsoft Graph API, endpoint mojawapo kwa data za Microsoft 365 services. Inakuwezesha kupata data na insights kutoka kwa huduma kama Azure AD, Office 365, Enterprise Mobility, na Security services.
 - `https://graph.microsoft.com`
 
-- **oss-rdbms (Azure Open Source Relational Databases)**: Inatumiwa kufikia huduma za Database za Azure kwa engines za relational za open-source kama MySQL, PostgreSQL, na MariaDB.
+- **oss-rdbms (Azure Open Source Relational Databases)**: Inatumika kufikia Azure Database services kwa engines za relational za open-source kama MySQL, PostgreSQL, na MariaDB.
 - `https://ossrdbms-aad.database.windows.net`
 
 </details>
 
 ### Access Tokens Scopes "scp"
 
-Scope ya access token imehifadhiwa ndani ya ufunguo scp ndani ya access token JWT. Scopes hizi zinaelezea ni nini access token inaruhusiwa kufikia.
+Wigo (scope) wa access token umehifadhiwa ndani ya key scp ndani ya access token JWT. Scopes hizi zinaeleza nini access token ina ruhusa ya kufikia.
 
-Ikiwa JWT inaruhusiwa kuwasiliana na API maalum lakini **haina scope** ya kufanya hatua iliyohitajika, haitakuwa na uwezo wa kufanya hatua hiyo kwa JWT hiyo.
+Kama JWT inaruhusiwa kuwasiliana na API maalum lakini **haina scope** ya kutekeleza kitendo kilichotakiwa, **haitaweza kutekeleza kitendo** kwa JWT hiyo.
 
-### Mfano wa kupata refresh & access token
+### Get refresh & access token example
 ```python
 # Code example from https://github.com/secureworks/family-of-client-ids-research
 import msal
@@ -144,32 +217,32 @@ scopes=["https://graph.microsoft.com/.default"],
 )
 pprint(new_azure_cli_bearer_tokens_for_graph_api)
 ```
-### Other access token fields
+### Mashamba mengine ya access token
 
-- **appid**: ID ya programu inayotumika kuzalisha token
+- **appid**: Application ID iliyotumika kutengeneza tokeni
 - **appidacr**: The Application Authentication Context Class Reference inaonyesha jinsi client ilivyothibitishwa; kwa public client thamani ni 0, na ikiwa client secret imetumika thamani ni 1
 - **acr**: The Authentication Context Class Reference claim ni "0" wakati uthibitisho wa mtumiaji wa mwisho haukukidhi mahitaji ya ISO/IEC 29115.
-- **amr**: Authentication method inaonyesha jinsi token ilivyothibitishwa. Thamani ya “pwd” inaonyesha kuwa password ilitumika.
+- **amr**: The Authentication method inaonyesha jinsi tokeni ilivyothibitishwa. Thamani ya “pwd” inaonyesha kwamba nenosiri lilitumika.
 - **groups**: Inaonyesha vikundi ambavyo principal ni mwanachama.
-- **iss**: Issuer inatambulisha security token service (STS) iliyozalisha token. e.g. https://sts.windows.net/fdd066e1-ee37-49bc-b08f-d0e152119b04/ (the uuid is the tenant ID)
+- **iss**: iss inaonyesha security token service (STS) iliyotengeneza tokeni. e.g. https://sts.windows.net/fdd066e1-ee37-49bc-b08f-d0e152119b04/ (the uuid is the tenant ID)
 - **oid**: Object ID ya principal
 - **tid**: Tenant ID
-- **iat, nbf, exp**: Issued at (wakati ilitolewa), Not before (haiwezi kutumika kabla ya wakati huu, kawaida thamani sawa na iat), Expiration time.
+- **iat, nbf, exp**: Issued at (wakati ilitolewa), Not before (haiwezi kutumika kabla ya wakati huu, kawaida thamani ile ile kama iat), Expiration time.
 
 
 ## FOCI Tokens Privilege Escalation
 
-Hapo awali ilitajwa kuwa refresh tokens zinapaswa kuunganishwa na **scopes** zilizozalishwa nazo, na kwa **application** na **tenant** ambazo zilizalishwa. Ikiwa mojawapo ya mipaka hii itavunjika, inawezekana kupandisha vibali kwani kutakuwa na uwezo wa kuzalisha access tokens kwa resources na tenants nyingine ambazo mtumiaji ana ruhusa kwao na zikiwa na zaidi ya **scopes** kuliko ilivyokusudiwa awali.
+Hapo awali ilitajwa kwamba refresh tokens zinapaswa kufungwa kwa **scopes** zilizoanzishwa nazo, kwa **application** na **tenant** zilizoanzishwa. Ikiwa mipaka yoyote ya hizi itavunjwa, inawezekana kuinua vibali kwa kuwa kutakuwa na uwezekano wa kuzalisha access tokens kwa rasilimali na tenants nyingine ambazo mtumiaji ana upatikanaji kwao na zikiwa na scopes zaidi kuliko ilikusudiwa awali.
 
-Zaidi ya hayo, **hii inawezekana kwa refresh tokens zote** katika [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/) (Microsoft Entra accounts, Microsoft personal accounts, and social accounts like Facebook and Google) kwa sababu kama [**docs**](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens) zinavyotaja: "Refresh tokens zimefungwa kwa mchanganyiko wa user na client, lakini **hazina uhusiano wa moja kwa moja na resource au tenant**. Client inaweza kutumia refresh token kupata access tokens **kwa mchanganyiko wowote wa resource na tenant** ambapo ina ruhusa kufanya hivyo. Refresh tokens zimefichwa (encrypted) na ni Microsoft identity platform pekee inaweza kuzisoma."
+Zaidi ya hayo, **this is possible with all refresh tokens** in the [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/) (Microsoft Entra accounts, Microsoft personal accounts, and social accounts like Facebook and Google) kwa sababu kama ilivyoelezwa katika [**docs**](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens): "Refresh tokens are bound to a combination of user and client, but **aren't tied to a resource or tenant**. A client can use a refresh token to acquire access tokens **across any combination of resource and tenant** where it has permission to do so. Refresh tokens are encrypted and only the Microsoft identity platform can read them."
 
-Zaidi ya hayo, kumbuka kuwa FOCI applications ni public applications, hivyo **hakuna secret inahitajika** ili kuthibitisha kwenye server.
+Zaidi ya hayo, kumbuka kuwa FOCI applications ni public applications, hivyo **hakuna secret inahitajika** ili kujithibitisha kwa server.
 
-Kisha FOCI clients zilizojulikana zilizoripotiwa katika [**original research**](https://github.com/secureworks/family-of-client-ids-research/tree/main) zinaweza [**kupatikana hapa**](https://github.com/secureworks/family-of-client-ids-research/blob/main/known-foci-clients.csv).
+Kisha wateja wa FOCI waliotajwa katika [**original research**](https://github.com/secureworks/family-of-client-ids-research/tree/main) wanaweza [**found here**](https://github.com/secureworks/family-of-client-ids-research/blob/main/known-foci-clients.csv).
 
-### Get different scope
+### Pata different scope
 
-Kwa kuendelea na mfano wa code uliotangulia, katika code hii inaomba token mpya kwa scope tofauti:
+Kufuata mfano wa code uliotangulia, katika code hii imesomwa tokeni mpya kwa scope tofauti:
 ```python
 # Code from https://github.com/secureworks/family-of-client-ids-research
 azure_cli_bearer_tokens_for_outlook_api = (
@@ -186,7 +259,7 @@ scopes=[
 )
 pprint(azure_cli_bearer_tokens_for_outlook_api)
 ```
-### Pata client na scopes tofauti
+### Pata client tofauti na scopes
 ```python
 # Code from https://github.com/secureworks/family-of-client-ids-research
 microsoft_office_client = msal.PublicClientApplication("d3590ed6-52b3-4102-aeff-aad2292ab01c")
@@ -204,32 +277,33 @@ pprint(microsoft_office_bearer_tokens_for_graph_api)
 ```
 ## NAA / BroCI (Nested App Authentication / Broker Client Injection)
 
-A BroCI refresh token ni pattern ya brokered token exchange ambapo refresh token iliyopo inatumika pamoja na vigezo vya ziada vya broker ili kuomba tokeni kwa niaba ya app nyingine ya first-party inayotambulika.
+A BroCI refresh tokens is a brokered token exchange pattern where an existing refresh token is used with extra broker parameters to request tokens as another trusted first-party app.
 
-Refresh token hizi lazima zitengenezwe (minted) katika muktadha huo wa broker (refresh token ya kawaida kwa kawaida haiwezi kutumika kama BroCI refresh token).
+These refresh tokens must be minted in that broker context (a regular refresh token usually cannot be used as a BroCI refresh token).
 
 ### Goal and purpose
 
-Lengo la BroCI ni kutumia tena session halali ya mtumiaji kutoka kwa mnyororo wa app zenye uwezo wa broker na kuomba tokeni kwa jozi ya app/resource nyingine inayotambulika. Hivyo, kuruhusu "escalate privileges" kutoka kwa tokeni ya awali.
+Lengo la BroCI ni kutumia tena session halali ya mtumiaji kutoka kwa mnyororo wa app inayoweza kuwa broker na kuomba tokens kwa app/resource nyingine inayotegemewa. Hivyo, kuruhusu "kuongeza ruhusa" kutoka kwa token ya asili.
 
-Kama mtazamo wa mashambulizi, hili ni muhimu kwa sababu:
+Kwa mtazamo wa ofensiv, hili ni muhimu kwa sababu:
 
-- Inaweza kufungua njia za first-party zilizotanguliwa kupewa idhini ambazo hazipatikani kwa kubadilishana refresh za kawaida.
-- Inaweza kurudisha access tokens kwa API zenye thamani kubwa (kwa mfano, Microsoft Graph) chini ya utambulisho wa app zenye ruhusa pana za delegated.
-- Inapanua fursa za ku-pivot tokeni baada ya authentication zaidi ya kubadili client wa klasik wa FOCI.
+- Linaweza kufungua njia za first-party app ambazo tayari zimekubaliwa (pre-consented) ambazo hazipatikani kwa ubadilishanaji wa refresh wa kawaida.
+- Linaweza kurudisha access tokens kwa APIs zenye thamani kubwa (kwa mfano, Microsoft Graph) chini ya vitambulisho vya app zenye delegated permissions pana.
+- Linaongeza fursa za pivoting za token baada ya authentication zaidi ya kubadilisha FOCI client za kawaida.
 
-Kinachobadilika katika NAA/BroCI refresh token si muundo unaoonekana wa tokeni, bali muktadha wa utoaji na metadata inayohusiana na broker ambayo Microsoft inathibitisha wakati wa operesheni za refresh zinazofanywa kupitia broker.
+Kinachobadilika katika NAA/BroCI refresh token sio muundo wa token unaoonekana, bali ni muktadha wa utoaji (issuance context) na metadata inayohusiana na broker ambayo Microsoft inathibitisha wakati wa operesheni za brokered refresh.
 
-NAA/BroCI token exchanges sio sawa na kubadilishana refresh ya kawaida ya OAuth.
+NAA/BroCI token exchanges si sawa na OAuth refresh exchange ya kawaida.
 
-- Refresh token ya kawaida (kwa mfano iliyopatikana kupitia device code flow) kwa kawaida inatumika kwa operesheni za kawaida za `grant_type=refresh_token`.
-- Ombi la BroCI linajumuisha muktadha wa ziada wa broker (`brk_client_id`, broker `redirect_uri`, na `origin`).
-- Microsoft inathibitisha kama refresh token iliyowasilishwa ilitengenezwa (minted) katika muktadha wa brokeri unaolingana.
-- Kwa hivyo, refresh token nyingi "za kawaida" zinashindwa katika maombi ya BroCI kwa makosa kama `AADSTS900054` ("Specified Broker Client ID does not match ID in provided grant").
-- Kwa ujumla huwezi "kubadilisha" refresh token ya kawaida kuwa BroCI‑inayokubalika kwa kutumia code.
-- Unahitaji refresh token iliyotolewa tayari na flow ya brokeri inayofaa.
+- A regular refresh token (for example obtained via device code flow) is usually valid for standard `grant_type=refresh_token` operations.
+- A BroCI request includes additional broker context (`brk_client_id`, broker `redirect_uri`, and `origin`).
+- Microsoft validates whether the presented refresh token was minted in a matching brokered context.
+- Therefore, many "normal" refresh tokens fail in BroCI requests with errors such as `AADSTS900054` ("Specified Broker Client ID does not match ID in provided grant").
+- You generally cannot "convert" a normal refresh token into a BroCI-valid one in code.
+- You need a refresh token already issued by a compatible brokered flow.
+
+Check the web <https://entrascopes.com/> to find BroCI configured apps an the trust relationships they have.
 
-Angalia wavuti <https://entrascopes.com/> ili kupata apps zilizopangwa kwa BroCI na uhusiano wa kuaminiana waliyonayo.
 
 ### Mental model
 
@@ -237,27 +311,27 @@ Fikiria BroCI kama:
 
 `user session -> brokered refresh token issuance -> brokered refresh call (brk_client_id + redirect_uri + origin) -> access token for target trusted app/resource`
 
-Kama sehemu yoyote ya mnyororo huo wa brokeri haitalingana, kubadilishana kutashindwa.
+Ikiwa sehemu yoyote ya mnyororo huo wa broker haifai, ubadilishanaji utakosa.
 
 ### Where to find a BroCI-valid refresh token
 
-Njia moja ya vitendo ni kukusanya trafiki ya portal kwenye browser:
+Njia ya vitendo ni kukusanya traffic ya portal ya browser:
 
-1. Ingia kwenye `https://entra.microsoft.com` (au Azure portal).
-2. Fungua DevTools -> Network.
-3. Chuja kwa:
+1. Sign in to `https://entra.microsoft.com` (or Azure portal).
+2. Open DevTools -> Network.
+3. Filter for:
 - `oauth2/v2.0/token`
 - `management.core.windows.net`
-4. Tambua jibu la tokeni lililosimamiwa na broker na nakili `refresh_token`.
-5. Tumia refresh token hiyo pamoja na vigezo vinavyolingana vya BroCI (`brk_client_id`, `redirect_uri`, `origin`) wakati wa kuomba tokeni kwa ajili ya apps lengwa (kwa mfano matukio ya ADIbizaUX / Microsoft_Azure_PIMCommon).
+4. Identify the brokered token response and copy `refresh_token`.
+5. Use that refresh token with matching BroCI parameters (`brk_client_id`, `redirect_uri`, `origin`) when requesting tokens for target apps (for example ADIbizaUX / Microsoft_Azure_PIMCommon scenarios).
 
 ### Common errors
 
-- `AADSTS900054`: Muktadha wa refresh token hauendani na broker tuple iliyotolewa (`brk_client_id` / `redirect_uri` / `origin`) au tokeni sio kutoka kwa flow ya portal iliyosimamiwa na broker.
-- `AADSTS7000218`: Flow ya client iliyochaguliwa inatarajia credential ya siri (`client_secret`/assertion), mara nyingi huonekana unapojaribu device code na client isiyo-public.
+- `AADSTS900054`: The refresh token context does not match the supplied broker tuple (`brk_client_id` / `redirect_uri` / `origin`) or the token is not from a brokered portal flow.
+- `AADSTS7000218`: The selected client flow expects a confidential credential (`client_secret`/assertion), often seen when trying device code with a non-public client.
 
 <details>
-<summary>Msaidizi wa Python kwa BroCI refresh (broci_auth.py)</summary>
+<summary>Python BroCI refresh helper (broci_auth.py)</summary>
 ```python
 #!/usr/bin/env python3
 """
@@ -532,30 +606,31 @@ raise SystemExit(main())
 
 ## Wapi pa kupata tokens
 
-Kutoka kwa mtazamo wa mshambuliaji, ni jambo la kuvutia kujua wapi inawezekana kupata access tokens na refresh tokens, kwa mfano wakati PC ya mwathiriwa imevamiwa:
+Kutoka kwa mtazamo wa mshambulizi ni ya kuvutia kujua ni wapi inawezekana kupata access and refresh tokens, kwa mfano wakati PC ya mwathirika imevamiwa:
 
 - Inside **`<HOME>/.Azure`**
 - **`azureProfile.json`** ina taarifa kuhusu watumiaji waliokuwa wameingia hapo awali
 - **`clouds.config contains`** ina taarifa kuhusu subscriptions
-- **`service_principal_entries.json`** ina application credentials (tenant id, clients na secret). Tu katika Linux & macOS
-- **`msal_token_cache.json`** ina access tokens na refresh tokens. Tu katika Linux & macOS
-- **`service_principal_entries.bin`** na `msal_token_cache.bin` zinatumiwa katika Windows na zimefungwa kwa DPAPI
-- **`msal_http_cache.bin`** ni cache ya HTTP requests
+- **`service_principal_entries.json`** ina application credentials (tenant id, clients and secret). Only in Linux & macOS
+- **`msal_token_cache.json`** ina access tokens na refresh tokens. Only in Linux & macOS
+- **`service_principal_entries.bin`** and msal_token_cache.bin zinatumika Windows na zimefichwa kwa DPAPI
+- **`msal_http_cache.bin`** ni cache ya HTTP request
 - Load it: `with open("msal_http_cache.bin", 'rb') as f: pickle.load(f)`
-- **`AzureRmContext.json`** ina taarifa kuhusu logins za awali zilizofanywa kwa kutumia Az PowerShell (lakini hakuna credentials)
-- Ndani ya **`C:\Users\<username>\AppData\Local\Microsoft\IdentityCache\*`** kuna faili kadhaa `.bin` zenye **access tokens**, ID tokens na taarifa za akaunti zilizosimbwa kwa DPAPI ya mtumiaji.
-- Inawezekana kupata zaidi **access tokens** kwenye faili `.tbres` ndani ya **`C:\Users\<username>\AppData\Local\Microsoft\TokenBroken\Cache\`** ambazo zina base64 iliyosimbwa kwa DPAPI yenye access tokens.
-- Katika Linux na macOS unaweza kupata **access tokens, refresh tokens na id tokens** kutoka Az PowerShell (ikiwa imetumika) kwa kukimbia `pwsh -Command "Save-AzContext -Path /tmp/az-context.json"`
-- Kwenye Windows hii huunda tu id tokens.
-- Inawezekana kuona kama Az PowerShell ilitumika katika Linux na macOS kwa kuangalia kama `$HOME/.local/share/.IdentityService/` inapatikana (ingawa faili zilizo ndani ni tupu na hazina maana)
-- Ikiwa mtumiaji ameingia ndani ya Azure kupitia browser, kulingana na hii [**post**](https://www.infosecnoodle.com/p/obtaining-microsoft-entra-refresh?r=357m16&utm_campaign=post&utm_medium=web) inawezekana kuanzisha mchakato wa uthibitisho kwa **redirect to localhost**, kufanya browser iidhinishe kuingia kiotomatiki, na kupokea refresh token. Kumbuka kuwa kuna programu chache za FOCI zinazoruhusu redirect kwenda localhost (kama az cli au powershell module), hivyo programu hizi lazima ziweze kuruhusiwa.
-- Chaguo jingine kama ilivyoelezwa kwenye blog ni kutumia zana [**BOF-entra-authcode-flow**](https://github.com/sudonoodle/BOF-entra-authcode-flow) ambayo inaweza kutumia programu yoyote kwa sababu itapata OAuth code kisha kupata refresh token kutoka kwenye title ya ukurasa wa mwisho wa uthibitisho kwa kutumia redirect URI `https://login.microsoftonline.com/common/oauth2/nativeclient`.
+- **`AzureRmContext.json`** ina taarifa kuhusu logins za zamani zikitumika Az PowerShell (lakini hakuna credentials)
+- Inside **`C:\Users\<username>\AppData\Local\Microsoft\IdentityCache\*`** kuna faili kadhaa `.bin` zenye **access tokens**, ID tokens na taarifa za akaunti zilizofichwa kwa DPAPI ya mtumiaji.
+- Inawezekana kupata zaidi za **access tokens** katika faili `.tbres` ndani ya **`C:\Users\<username>\AppData\Local\Microsoft\TokenBroken\Cache\`** ambazo zina base64 iliyofichwa kwa DPAPI yenye access tokens.
+- Katika Linux na macOS unaweza kupata **access tokens, refresh tokens and id tokens** kutoka Az PowerShell (ikiwa imetumika) kwa kukimbiza `pwsh -Command "Save-AzContext -Path /tmp/az-context.json"`
+- Katika Windows hii inatengeneza id tokens tu.
+- Inawezekana kuona ikiwa Az PowerShell ilitumika katika Linux na macOS kwa kukagua kama `$HOME/.local/share/.IdentityService/` ipo (hata hivyo faili zilizomo ni tupu na hazina maana)
+- Ikiwa mtumiaji ame **logged inside Azure with the browser**, kulingana na hii [**post**](https://www.infosecnoodle.com/p/obtaining-microsoft-entra-refresh?r=357m16&utm_campaign=post&utm_medium=web) inawezekana kuanzisha authentication flow na **redirect to localhost**, kufanya browser ikatekee kuidhinisha login, na kupokea refresh token. Kumbuka kwamba kuna few FOCI applications tu zinazoruhusu redirect to localhost (kama az cli au powershell module), hivyo applications hizo lazima ziwezijiruhusiwa.
+- Chaguo jingine lililoelezewa kwenye blog ni kutumia zana [**BOF-entra-authcode-flow**](https://github.com/sudonoodle/BOF-entra-authcode-flow) ambayo inaweza kutumia application yoyote kwa sababu ita **get the OAuth code to then get a refresh token from the title of the final auth** page ikitumia redirect URI `https://login.microsoftonline.com/common/oauth2/nativeclient`.
 
-## Marejeo
+## References
 
 - [https://github.com/secureworks/family-of-client-ids-research](https://github.com/secureworks/family-of-client-ids-research)
 - [https://github.com/Huachao/azure-content/blob/master/articles/active-directory/active-directory-token-and-claims.md](https://github.com/Huachao/azure-content/blob/master/articles/active-directory/active-directory-token-and-claims.md)
 - [https://specterops.io/blog/2025/10/15/naa-or-broci-let-me-explain/](https://specterops.io/blog/2025/10/15/naa-or-broci-let-me-explain/)
 - [https://specterops.io/blog/2025/08/13/going-for-brokering-offensive-walkthrough-for-nested-app-authentication/](https://specterops.io/blog/2025/08/13/going-for-brokering-offensive-walkthrough-for-nested-app-authentication/)
+- [https://trustedsec.com/blog/full-disclosure-a-third-and-fourth-azure-sign-in-log-bypass-found](https://trustedsec.com/blog/full-disclosure-a-third-and-fourth-azure-sign-in-log-bypass-found)
 
 {{#include ../../../banners/hacktricks-training.md}}