---
title: "Discussion on \"GhostLoot part 2: the Microsoft cookie mess, the inbox, and the Google wall\" | Hashnode"
description: "Discussion on \"GhostLoot part 2: the Microsoft cookie mess, the inbox, and the Google wall\". Part 1 got the loot out of Evilginx's session list. Part 2 is what I learned the hard way after that: which Microsoft cookie is actually money, which \"TTL\" is a fiction, how the panel had to stop bein"
url: "https://hashnode.com/posts/ghostloot-part-2-the-microsoft-cookie-mess-the-inbox-and-the-google-wall/6aa028eccab6deed1c0a8b00"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [GhostLoot part 2: the Microsoft cookie mess, the inbox, and the Google wall](https://blog.redghostops.com/ghostloot-part-2-the-microsoft-cookie-mess-the-inbox-and-the-google-wall?utm_source=hashnode&utm_medium=feed)

Part 1 got the loot out of Evilginx's session list. Part 2 is what I learned the hard way after that: which Microsoft cookie is actually money, which "TTL" is a fiction, how the panel had to stop bein

Sep 8 · 8 min read · blog.redghostops.com  
Read the article

-   [#evilginx](https://hashnode.com/tag/evilginx)
-   [#red-team](https://hashnode.com/tag/red-team)
-   [#aitm](https://hashnode.com/tag/aitm)
-   [#microsoft](https://hashnode.com/tag/microsoft)

## Written by

[Marco Carola](https://hashnode.com/@marcocarola)

@marcocarola

  
[View profile](https://hashnode.com/@marcocarola)

pentest

## Responses 1

Markdown supported · ⌘↵ to post

[robyncastrm247-hue](https://hashnode.com/@robyncastrm247)

[5d ago](https://hashnode.com/posts/ghostloot-part-2-the-microsoft-cookie-mess-the-inbox-and-the-google-wall/6aa028eccab6deed1c0a8b00/comment/6aee4a5967d9c830d8d8ca2b)

How can I reach you personally?