This repository contains a collection of tools and resources related to the Pass-the-Passkey family of attacks, which target WebAuthn and FIDO2 authentication mechanisms in Windows and were featured in the Black Hat USA 2026 talk. These tools are designed for security researchers and penetration testers to assess the security of systems that use passkey-based authentication.
Warning
The techniques described in this repository are intended for educational purposes only. Unauthorized use of these procedures may violate laws and regulations.
The Passkey Injector is a simple web browser built on the Edge WebView2 control that intercepts WebAuthn assertion requests and allows responses to be injected in JSON format.
There are multiple use cases for tampering with the passkey authentication flow, including:
- Replay of captured assertions from network traffic, API hooks, or browser logs.
- Phishing attacks by forwarding attacker-controlled assertions.
- Injection of modified assertions to test server-side validation.
- Signing challenges using stolen synchronized passkeys, e.g., from KeePassXC or Bitwarden.
- Analysis of WebAuthn features and extensions used by a particular cloud service.
- Learning how the WebAuthn protocol works.
This tool is a .NET Framework 4.8 assembly designed to be executed as a payload by a Windows C2 agent like Apollo, part of the Mythic C2 framework.
The main purpose of this payload is to display a passkey authentication prompt to the user and retrieve the resulting assertion. It can also list available Windows Hello credentials and monitor the Windows Event Log for new WebAuthn authentication events. Microsoft Entra ID challenges can be signed directly with a local Windows Hello for Business key when that key is already unlocked.
See the SharpPasskeys documentation for more information.
The WebAuthn Hook is a native DLL that SharpPasskeys can inject into browser processes.
It uses Microsoft Detours to intercept the WebAuthNAuthenticatorGetAssertion Win32 API call,
allowing operators to observe and tamper with the WebAuthn assertion workflow.
The hook communicates with the SharpPasskeys process over the \\.\pipe\WebAuthnHook named pipe.
Through this control channel, SharpPasskeys can monitor assertion requests and responses, capture the
resulting PublicKeyCredential, inject a replacement challenge, or withhold
a successful assertion from the browser.
See the WebAuthn Hook documentation for more information.
Passkey UI is a simple Windows application that provides a graphical user interface for interacting with the Windows WebAuthn API. The source code of this tool is hosted in the webauthn-interop repository.
The DSInternals.Passkeys PowerShell module lets Microsoft Entra ID and Okta administrators register passkeys on behalf of other users. The source code of this module is hosted in the webauthn-interop repository.
We have decided not to publish our BOF implementation of SharpPasskeys yet.
Passkey Raider is a Burp Suite extension for testing and manipulating passkey authentication flows.
passkeys.tools is an analysis and debugging platform for passkey implementations, developed at Ruhr University Bochum.
Fabian Bader's Invoke-EntraIDPasskeyLogin.ps1, part of the TokenTacticsV2 toolkit, performs a non-interactive Entra ID sign-in using a WebAuthn private key extracted from a synced vault (Bitwarden, 1Password, KeePassXC) and returns OAuth tokens usable against Microsoft Graph. A modified variant, Invoke-EntraPasskeyInjection.ps1, is included in this repository and accepts a precomputed PublicKeyCredential payload so it can be chained with assertions from the Passkey Injector and SharpPasskeys tools.
