News for hackers. Stuff that matters.

A comment on Hacking Slack using postMessage and WebSocket-reconnect to steal your token.

Re:Hacking Slack using postMessage and WebSocket-reconnect t... by EnigmaticLion on Wednesday March 01, 2017 @12:38AM (#13761474)
Just out of curiosity, how long did it take for you to come up with this PoC? From the initial notice that something might be exploitable until you sent the email to slack?

Your post makes it look so easy, but it would surely take weeks for me to figure out all these things.

[ Parent | on HN ]
Re:Hacking Slack using postMessage and WebSocket-reconnect t... by fransr on Wednesday March 01, 2017 @03:00AM (#13762121)
It's a common pitfall and easy to look for. The stuff I spent most time with regarding this specific issue was finding the proper event that did something bad.
[ Parent | on HN ]
Re:Hacking Slack using postMessage and WebSocket-reconnect t... by lightedman on Wednesday March 01, 2017 @02:34AM (#13762027)
Personally, my first clue is that token protection/revocation is rarely implemented properly. It's one of the first things I look at when dealing with a web-based system which is obviously using them.
[ Parent | on HN ]