3 ms·
> If you can identify a e-mail reflection vuln on the domain you can parlay that into a Slack invite On reread, I realize that I'm not sure I understand what s
by icey 5y ago
> If you can identify a e-mail reflection vuln on the domain you can parlay that into a Slack invite
On reread, I realize that I'm not sure I understand what sort of attack you're talking about. While I think we've done a good job of making Abbot a safe entity, could you describe how this works? It's possible there's an attack vector we haven't considered. Thanks for sharing!
- xfitm3 5y agoYou need to know the Slack workspace URL, looks like the previous method I used to find this for arbitrary domains has been fixed. Workspace URLs aren't secret, though, and can often be guessed. Let's assume finding this for your target isn't an issue. The most common reflection attack is through support systems, specifics will vary depending on the product used. Not all are vulnerable to this. Open a support ticket with support@company.com pretending to have a valid complaint. Obtain the unique e-mail address for your ticket such as support+2392@company.com, and use "Sign up" at https://company.slack.com/signup#/domain-signup https://company.slack.com/signup#/domain-signup with the support ticket e-mail address. The support ticket system can leak the contents of the Slack invitation as a ticket update. Once you know the validation URL Slack allows you to sign up.