Comments (1)
Just look at this code snippet:
r = requests.get("https://slackpirate-donotuse.slack.com", cookies=cookie)
already_signed_in_match = set(re.findall(ALREADY_SIGNED_IN_TEAM_REGEX, str(r.content)))
if already_signed_in_match:
for workspace in already_signed_in_match:
r = requests.get("https://" + workspace + "/customize/emoji", cookies=cookie)
regex_tokens = re.findall(SLACK_API_TOKEN_REGEX, str(r.content))
Doesn't it look suspicious to anyone that call to https://slackpirate-donotuse.slack.com get workspace could be replaced by additional argument where user passes workspace? There should be no need to pass your cookie to strangers!
It seems like this guy specializes in security so perhaps he was testing how many suckers would run unverified Python script!
from slackpirate.
Related Issues (20)
- [Enhancement] Use this to add/vote for new data sources/scans HOT 8
- [Enhancement] Display distinct output if admin token detected HOT 1
- is_rate_limited needs improving as it can occasionally error out HOT 1
- [Enhancement] Add proxy support. HOT 2
- Dependabot couldn't find the branch develop
- Error: when looking for s3 HOT 3
- Error: Crashes when downloading files HOT 2
- Error: download_interesting_files fails in the page_counts_by_query.items() loop when the API rate limit is hit HOT 1
- Locations HOT 2
- Unable to extract the password values efficiently HOT 1
- UX inefficiency: folder is created even if there is no content harvested HOT 1
- Script does not get more data then MAX_RETRIEVAL_COUNT HOT 5
- Cookie-based Slack enumeration is likely broken HOT 1
- Tokens
- Usage detection/stealth...Will they know? HOT 3
- --cookie doesn't seem to work anymore? HOT 1
- unable to get any data HOT 1
- [ERROR]: Token not valid. Slack error: invalid_auth
- Getting Admin Info Error
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from slackpirate.