slack-watchman - Slack enumeration and exposed secrets detection to

项目说明

<img src=" width="550">

Slack Watchman

!Python 2.7 and 3 compatible
!PyPI
!License: MIT

Monitoring and enumerating Slack for exposed secrets

About Slack Watchman

<img src="/images/slack_watchman.png" width="500">

Slack Watchman is an application that uses the Slack API to find potentially sensitive data exposed in a Slack workspace, and to enumerate other useful information for red, blue and purple teams.

More information about Slack Watchman can be found on my blog.

Features

#### Secrets Detection
<img src="/images/slack_watchman_finding.png" width="500">

Slack Watchman looks for:

API Keys, Tokens & Service Accounts

- AWS, Azure, GCP, Google API, Slack (keys & webhooks), Twitter, Facebook, GitHub and more
- Generic Private keys
- Access Tokens, Bearer Tokens, Client Secrets, Private Tokens

Files

- Certificate files
- Potentially interesting/malicious/sensiti (.docm, .xlsm, .zip etc.)
- Executable files
- Keychain files
- Config files for popular services (Terraform, Jenkins, OpenVPN and more)

Personal Data

- Leaked passwords
- Passport numbers, Dates of birth, Social security numbers, National insurance numbers and more

Financial data

- Paypal Braintree tokens, Bank card details, IBAN numbers, CUSIP numbers and more

#### Time based searching
You can run Slack Watchman to look for results going back as far as:

24 hours

7 days

30 days

All time

#### Enumeration
<img src="/images/slack_watchman_enumeration.png" width="500">

It also enumerates the following:

User data

- All users & all admins

Con data

- All con, including externally shared con
- All con that include a Slack Canvas (which often contain sensitive or important information)

Workspace authentication options

This means after one deep scan, you can schedule Slack Watchman to run regularly and only return results from your chosen timeframe.

#### Unauthenticated Probe
<img src="/images/slack_watchman_probe.png" width="500">

You can run Slack Watchman in unauthenticated probe mode to enumerate authentication options and other information on a Workspace. This doesn't need a token, and returns:

Workspace name

Workspace ID

Appro (which can create accounts)

OAuth pro

SSO auth status

Two-factor requirements

To run this mode use Slack Watchman with the --probe flag and the workspace domain to probe:

Signatures

Slack Watchman uses custom YAML signatures to detect matches in Slack. These signatures are pulled from the central Watchman Signatures repository. Slack Watchman automatically updates its signature base at runtime to ensure its using the latest signatures to detect secrets.

#### Suppressing Signatures
You can define signatures that you want to disable when running Slack Watchman by adding their IDs to the disabled_signatures section of the watchman.conf file. For example:

You can find the ID of a signature in the indi YAML files in Watchman Signatures repository.

Logging

Slack Watchman gives the following logging options:

Terminal-friendly Stdout

JSON to Stdout

Slack Watchman defaults to terminal-friendly stdout logging if no option is given. This is designed to be easier for humans to read.

JSON logging is also a, which is perfect for ingesting into a SIEM or other log analysis platforms.

JSON formatted logging can be easily redirected to a file as below:

Authentication Requirements

Slack API token

To run Slack Watchman, you will need a Slack API OAuth access token. You can do this by creating a simple Slack App.

The app needs to have the following User Token Scopes added:

Note: User tokens act on behalf of the user who authorises them, so I would suggest you create this app and authorise it using a service account, otherwise the app will ha to your private con and chats.

#### App Manifest
Slack apps can be created from JSON manifests which define the details of the application and the scopes to approve. The app manifest for Slack Watchman can be found in docs/app_manifest.json, you can use this to speed up creating your Slack app.

Cookie Authentication

Alternatively, Slack Watchman can also authenticate to Slack using a user d cookie, which is stored in the browser of each user logged into a workspace.

To use cookie authentication, you will need to provide the d cookie, and the URL of the target workspace. Then you will need to use the --cookie flag when running Slack Watchman

More information on cookie authentication can be found on my blog
#### Pro tokens
Slack Watchman will first try to get the Slack token (plus the cookie token and URL if selected) from the en

SLACK_WATCHMAN_TOKEN

SLACK_WATCHMAN_COOKIE

SLACK_WATCHMAN_URL

If this fails it will try to load the token(s) from .conf file (see below).

#### watchman.conf file
Configuration options can be passed in a file named watchman.conf which must be stored in your home directory. The file should follow the YAML format, and should look like below:

Slack Watchman will look for this file at runtime, and use the configuration options from here. If you are not using cookie auth, leave cookie and url blank.

If you are having issues with your .conf file, run it through a YAML linter.

An example file is in docs/example.conf

Note: Cookie and URL are optional, and not required if not using cookie authentication.

Installation

The recommended way to install Slack Watchman is via pipx, which installs the app in an isolated en and makes it a on your system PATH:

Alternati via pip

You can also install Slack Watchman using pip:

Alternati from Source

Download the release source files, then from the top-le of the repository, run:

Docker Image

Slack Watchman is also a from the Docker hub as a Docker image:

docker pull papermountain/slack-watchman:latest

You can then run Slack Watchman in a container, making sure you pass the required en :

Usage

Slack Watchman will be installed as a global command, use as follows:

You can run Slack Watchman to look for e, and output to default stdout:

Other Watchman apps

You may be interested in the other apps in the Watchman family:

Slack Watchman for Enterprise Grid

GitLab Watchman

GitHub Watchman

License

The source code for this project is released under the GNU General Public Licence. This project is not associated with Slack Technologies or Salesforce.

项目信息

开发语言：Python

Star 数：404

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Slack enumeration and exposed secrets detection tool展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。