You will also need a web server to handle the OAuth flow. Use the app to exfiltrate data from workspaces that install itĪs mentioned earlier, Github is a good start for scraping publicly committed webhook data.Track workspaces that install the malicious app.

Send malicious messages to discovered hooks.Create a Slack app and allow public installation of the app.The last assumption is true - webhooks can only accept data. So if you can find a webhook created by an admin - congrats, you can post to admin channels!Ī quick search on Github shows 130,989 public code results containing Slack webhook URLs, with a majority containing the full unique webhook value.

You'll receive this error with a HTTP 403.” Slack documentation suggests that allowed target channels are based on the original creator of the webhook: “posting_to_general_channel_denied is thrown when an incoming webhook attempts to post to the '#general' channel for a workspace where posting to that channel is 1) restricted and 2) the creator of the same incoming webhook is not authorized to post there. In some cases, this can also override channel posting permissions (such as admin-only posting). Considering sending to #general, #engineering, and other default or common channels to target a wider audience. If you gain access to a webhook for one channel, you can use it in others. The webhook only accepts data, and thus alone cannot expose sensitive data to third parties.Ī deeper dive into webhooks shows that this is not entirely accurate.įirst, a channel override allows you to override the previously specified webhook target channel by adding the “channel” key to your JSON payload.Webhook configuration requires selection of a target channel, reducing the scope of abuse to a single channel.Generally, Slack webhooks are considered a low risk integration due to the following assumptions: By specifying a unique URL, your message body, and a destination channel, you can send a message to any webhook that you know the URL for in any workspace, regardless of membership. Slack Incoming Webhooks allow you to post messages from your applications to Slack.

It is feature-rich, offering additional functionality such as video calling and screen sharing in addition to a marketplace containing thousands of third-party applications and add-ons. Slack is a cloud-based messaging platform that is commonly used in workplace communications.

Incoming webhook slack