Package: slack-watchman
Slack WatchmanMonitoring and enumerating Slack for exposed secretsAbout Slack WatchmanSlack Watchman is an application that uses the Slack API to find potentially sensitive data exposed in a Slack workspace, and to enumerate other useful information for red, blue and purple teams.More information about Slack Watchman can be foundon my blog.FeaturesSlack Watchman looks for:API Keys, Tokens & Service AccountsAWS, Azure, GCP, Google API, Slack (keys & webhooks), Twitter, Facebook, GitHub and moreGeneric Private keysAccess Tokens, Bearer Tokens, Client Secrets, Private TokensFilesCertificate filesPotentially interesting/malicious/sensitive files (.docm, .xlsm, .zip etc.)Executable filesKeychain filesConfig files for popular services (Terraform, Jenkins, OpenVPN and more)Personal DataLeaked passwordsPassport numbers, Dates of birth, Social security numbers, National insurance numbers and moreFinancial dataPaypal Braintree tokens, Bank card details, IBAN numbers, CUSIP numbers and moreIt also enumerates the following:User dataAll users & all adminsChannel dataAll channels, including externally shared channelsTime based searchingYou can run Slack Watchman to look for results going back as far as:24 hours7 days30 daysAll timeThis means after one deep scan, you can schedule Slack Watchman to run regularly and only return results from your chosen timeframe.SignaturesSlack Watchman uses custom YAML signatures to detect matches in Slack. These signatures are pulled from the centralWatchman Signatures repository. Slack Watchman automatically updates its signature base at runtime to ensure its using the latest signatures to detect secrets.LoggingSlack Watchman gives the following logging options:Terminal-friendly StdoutJSON to StdoutSlack Watchman defaults to terminal-friendly stdout logging if no option is given. This is designed to be easier for humans to read.JSON logging is also available, which is perfect for ingesting into a SIEM or other log analysis platforms.JSON formatted logging can be easily redirected to a file as below:slack-watchman --timeframe a --all --output json >> slack_watchman_log.jsonAuthentication RequirementsSlack API tokenTo run Slack Watchman, you will need a Slack API OAuth access token. You can do this by creating a simpleSlack App.The app needs to have the followingUser Token Scopesadded:channels:read
files:read
groups:read
im:read
links:read
mpim:read
remote_files:read
search:read
team:read
users:read
users:read.emailNote: User tokens act on behalf of the user who authorises them, so I would suggest you create this app and authorise it using a service account, otherwise the app will have access to your private channels and chats.Cookie AuthenticationAlternatively, Slack Watchman can also authenticate to Slack using a userdcookie, which is stored in the browser of each user logged into a workspace.To use cookie authentication, you will need to provide thedcookie, and the URL of the target workspace. Then you will need to use the--cookieflag when running Slack WatchmanMore information on cookie authentication can be foundon my blogProviding tokensSlack Watchman will first try to get the Slack token (plus the cookie token and URL if selected) from the environment variablesSLACK_WATCHMAN_TOKENSLACK_WATCHMAN_COOKIESLACK_WATCHMAN_URLIf this fails it will try to load the token(s) from.conffile (see below)..conf fileConfiguration options can be passed in a file namedwatchman.confwhich must be stored in your home directory. The file should follow the YAML format, and should look like below:slack_watchman:token:xoxp-xxxxxxxxcookie:xoxd-%2xxxxxurl:https://xxxxx.slack.comSlack Watchman will look for this file at runtime, and use the configuration options from here. If you are not using cookie auth, leavecookieandurlblank.If you are having issues with your .conf file, run it through a YAML linter.An example file is indocs/example.confNote: Cookie and URL values are optional, and not required if not using cookie authentication.InstallationYou can install the latest stable version via pip:python3 -m pip install slack-watchmanOr build from source yourself:Download the release source files, then from the top level repository run:python3 -m pip build
python3 -m pip install --force-reinstall dist/*.whlDocker ImageSlack Watchman is also available from the Docker hub as a Docker image:docker pull papermountain/slack-watchman:latestYou can then run Slack Watchman in a container, making sure you pass the required environment variables:// help
docker run --rm papermountain/slack-watchman -h

// scan all
docker run --rm -e SLACK_WATCHMAN_TOKEN=xoxp... papermountain/slack-watchman --timeframe a --all --output json
docker run --rm --env-file .env papermountain/slack-watchman --timeframe a --all --output stdoutUsageSlack Watchman will be installed as a global command, use as follows:usage: slack-watchman [-h] --timeframe {d,w,m,a} [--output {json,stdout}] [--version] [--all] [--users] [--channels] [--pii] [--secrets]
                      [--debug] [--verbose] [--cookie]

Monitoring and enumerating Slack for exposed secrets

options:
  -h, --help            show this help message and exit
  --output {json,stdout}, -o {json,stdout}
                        Where to send results
  --version, -v         show program's version number and exit
  --all, -a             Find secrets and PII
  --users, -u           Enumerate users and output them to .csv
  --channels, -c        Enumerate channels and output them to .csv
  --pii, -p             Find personal data: DOB, passport details, drivers licence, ITIN, SSN etc.
  --secrets, -s         Find exposed secrets: credentials, tokens etc.
  --debug, -d           Turn on debug level logging
  --verbose, -V         Turn on more verbose output for JSON logging. This includes more fields, but is larger
  --cookie              Use cookie auth using Slack d cookie. REQUIRES either SLACK_WATCHMAN_COOKIE and SLACK_WATCHMAN_URL environment
                        variables set, or both values set in watchman.conf

required arguments:
  --timeframe {d,w,m,a}, -t {d,w,m,a}
                        How far back to search: d = 24 hours w = 7 days, m = 30 days, a = all timeYou can run Slack Watchman to look for everything, and output to default stdout:slack-watchman --timeframe a --allOther Watchman appsYou may be interested in the other apps in the Watchman family:Slack Watchman for Enterprise GridGitLab WatchmanGitHub WatchmanLicenseThe source code for this project is released under theGNU General Public Licence. This project is not associated with Slack Technologies or Salesforce.[4.0.2] - 2023-06-14AddedAdded notification for an invalid cookie being passed (Fixes #47)FixedJSON output for User and Workspace information was malformed, this has now been fixed[4.0.1] - 2023-05-05ChangedUser output in stdout logging now includes display name and email. The accounts for cases where usernames are nonsensical.[4.0.0] - 2023-05-03This major version release brings multiple updates to Slack Watchman in usability, functionality and behind the scenes improvements.Note: While efforts have been made to make sure there is some backwards compatibility, this release may have some breaking changes on previous versions. Make sure to look at the removed secionAddedSupport for centralised signatures from theWatchman Signatures repositoryThis makes it much easier to keep the signature base for all Watchman applications up to date, and to add functionality to Slack Watchman with new signatures. New signatures are downloaded, and updates to existing signatures are applied, at runtime, meaning Slack Watchman will always be using the most up to date signatures.Major UI overhaulA lot of feedback said Slack Watchman was hard to read. This version introduces new terminal optimised logging as a logging option, as well as JSON formatting. This formatting is now the default when running with no output option selected, and is a lot easier for humans to read. Also, colours!Cookie loginIf you have a Slackdcookie (which can be gathered from a web browser authenticated to Slack), and you know the URL of the target Slack workspace, Slack Watchman now allows you to authenticate using cookie auth, instead of supplying a bot token.Multiprocessing and other backend improvementsSlack Watchman now makes more efficient use of API calls, and incorporates multiprocessing, to run faster than previous versions. Larger workspaces can now be enumerated much quicker.Docker image supportSlack Watchman is now available as a Docker image. Simply pull from Docker Hubdocker pull papermountain/slack-watchman:latestMore useful enumeration options addedSlack Watchman now gathers more information on a workspace. Useful if your use case is more red than blue...Get information on calling userProvides you information on the user you are authenticated as, including whether the user has 2FA configured, whether they are an admin etc.CSV files containing information on all users and channels in the workspace.Option choose between verbose or succinct logging when using JSON output. Default is succinct.Debug logging optionRemovedSocket logging functionalityI'm not sure this functionality was used, but the move to more accessible stdout and JSON logging options means that the option to log to a listening socket has been removed.Some CSV outputFor the same reason as above, logging results to CSV has been removed. Enumerating users and channels can still be output to CSV, but formatting a CSV file for a complex nested datastructure is a nightmare, and makes future modifications time consuming.Logging to fileTo keep logging as simple as possible, the file output option has also been removed. This can easily be reproduced by piping the output of running Slack Watchman to a file:slack-watchman --timeframe w --all --output json >> sw-log.jsonLocal/custom signatures - Centralised signatures mean that user-created custom signatures can't be used with Slack Watchman for Enterprise Grid anymore. If you have made a signature you think would be good for sharing with the community, feel free to add it to the Watchman Signatures repository, so it can be used in all Watchman applications[3.0.10] - 2020-11-08FixedRetry added for occasional Requests HTTPSConnectionPool errorAddedVersion added to Stdout loggingBetter exception handling and logging exceptions correctlyWorkspace field added to critical error[3.0.9] - 2020-10-31AddedMailgun API token ruleMailchimp API token ruleTwilio API token ruleStripe API token ruleHeroku API token ruleShodan API token ruleCloudflare API token rule[3.0.8] - 2020-10-10AddedExact regex string match added to output from message searchesCheck added for when the given token doesn't have the required API scope. On incorrect scope, and exception will be raised and the required scope will be output to log[3.0.7] - 2020-10-02AddedRule to detect MasterCard Datacash credentials[3.0.6] - 2020-09-22ChangedFile searching now includes user who posted file via users.list API methodLogging field name changes = 'type' -> 'detection_type', 'detection' -> 'detection_data'[3.0.5] - 2020-09-18ChangedUpdated output to strip quotes from query strings. This should allow better JSON parsing with more log ingestorsFile searching was missing file type output in log data in some occasions, now fixed[3.0.4] - 2020-09-10AddedAdded rules to search for:CV filesFiles and spreadsheets containing budget and salary information[3.0.2] - 2020-09-06AddedCHANGELOG to track updatesSmall bug meant that PyPI installations weren't including the YAML rule files. This has now been fixed.ChangedTop level dir renamed fromwatchmantoslack_watchmanto place nicer with PyPI[3.0.0] - 2020-09-04AddedRules based searchingLogging options: Log file, Stdout, TCP streamDeduplication of outputRefactor into slack_wrapper to use a class to create an API clientChangedTop level dir renamed fromwatchmantoslack_watchmanto place nicer with PyPIRemovedCustom search by CSV. This is now done by creating your own custom rule