Hacking Slack using postMessage and WebSocket-reconnect to steal your token

Re:Hacking Slack using postMessage and WebSocket-reconnect t... by zaroth on Tuesday February 28, 2017 @09:29PM (#13760437)

One of the best vuln write-ups I've read in a while, in that it steps you through how the initial entrypoint was found, and the steps needed to turn that into a dangerous exploit.

I think what really makes this writeup worth the read is the insight it shows into the thought process of identifying an interesting bug and weaponizing it. Thanks Frans!

[ Parent | on HN ]

Re:Hacking Slack using postMessage and WebSocket-reconnect t... by fransr on Wednesday March 01, 2017 @03:15AM (#13762194)

Thanks a lot! I had a lot of fun doing it and I really wanted to get every step of the process out there, so that was some really nice feedback :)

[ Parent | on HN ]

Re:Hacking Slack using postMessage and WebSocket-reconnect t... by hubcaps on Tuesday February 28, 2017 @10:04PM (#13760620)

That was a really cool read. It's pretty awesome to see Slack patch it and pay them so quickly, if only all companies could operate like that.

[ Parent | on HN ]

Re:Hacking Slack using postMessage and WebSocket-reconnect t... by ridruejo on Tuesday February 28, 2017 @11:49PM (#13761227)

It is not the first one either. The Detectify team is top notch and I don't know how they and their product are not better known

[ Parent | on HN ]