Session Sushi is a zero dependency browser extension for handling cookies, Microsoft 365 OAuth tokens, and Graph API interactions. Build for security professionals.
- View all cookies in browser
- Import/export cookies as JSON
- Search and filter cookies
- Clear all cookies
- Incognito session support
- Acquire OAuth tokens
- Store multiple M365 refresh tokens as sessions
- Manual and automatic token refresh
- Session import/export
Graph, User, Directory, Mailbox, Calendar, OneDrive, SharePoint and Teams.
Use this extension in a isolated browser that does not interfer with your normal session. Preferly open a incognito/private window to fully isolate the sessions.
Download for Edge
Download for Chrome
The most secure way you can use an extension is by sideloading it manually, this way it does not auto update.
Option 1: Clone with Git
git clone https://github.com/phishingclub/session-sushi.gitOption 2: Download ZIP
- Go to https://github.com/phishingclub/session-sushi
- Click the "Code" button
- Select "Download ZIP"
- Extract the ZIP file to a location of your choice
Load in Chrome/Edge:
- Navigate to
chrome://extensions/oredge://extensions/ - Enable "Developer mode"
- Click "Load unpacked"
- Select the
session-sushidirectory (or the extracted folder if you downloaded the ZIP)
git clone https://github.com/phishingclub/session-sushi.git
cd session-sushiLoad the extension in developer mode and make changes. Reload extension after modifications.
- No dependencies allowed - vanilla JavaScript only
- Feature / Bug fixes in bug-* or feature-* branches
- Rebase branch to a single commit when it is ready to review / merge
- Ensure the last commit is performed signed to agree with CLA.
Important: All contributors must agree to our Contributor License Agreement (CLA).
By contributing to Phishing Club, you agree that your contributions will be licensed under the same dual license terms (AGPL-3.0 and commercial). You confirm that:
- You have the right to contribute the code
- Your contributions are your original work or properly attributed
- You grant Phishing Club the right to license your contributions under both AGPL-3.0 and commercial licenses
GNU Affero General Public License v3.0 (AGPL-3.0). See LICENSE.
- Community: Phishing Club Discord
- Phishing Club - Phishing simulation platform