Tradecraft - PaperMtn

slack

Extracting Rich Slack DLP Alerts

Slack’s audit logs don’t include enough context to investigate DLP detections. In this post, I show how to export the richer DLP details Slack displays in the admin console, and I use my slack-dlp-log-extractor script to do it via the DLP API. What is Slack DLP? Slack offers

Tradecraft

Secrets Management Part 2 – Encrypted Secret Retrieval with Gopass

In this post I explain how to use gopass to GPG encrypt and store your secrets locally, then integrate with direnv to decrypt and load your secrets to environment variables in your shell without exposing them in plaintext. In Part 1 of this Secrets Management series I showed you: * How

Slack Watchman

Probing Slack Workspaces for Authentication Information and other Treats

Did you know that Slack provides some surprising information about a workspace to unauthenticated callers? Slack Watchman knows, and in this post I’m going to show you the information you can enumerate from a workspace, and how you can use the ‘unauthenticated probe’ functionality of Slack Watchman to get

Lil Pwny

Generating a Rich Custom Wordlist to use with Lil Pwny

In this post I show how you can use some of the same tools that attackers use to generate a tailored custom password list to use with Lil Pwny, and find those risky passwords before they do. As the number of data breaches continue to rise, safeguarding your Active Directory

Tradecraft

Secrets Management - Managing Environment Variables with Direnv

Many of my tools, such as GitLab Watchman, are designed to find secrets hardcoded or added as files to code repositories. Handling secrets this way is a bad idea for a number of reasons, but the main issue is that it leaves them open to being exposed. In this post,

Tradecraft

Retrieving and Using Slack Cookies for Authentication

This post has been updated in December 2025 to account for changes to Slack authentication since it was originally written. Slack, like many other services, uses cookies to store authentication and session information. What is interesting with Slack, however, is that one particular cookie can be used to generate a

Tradecraft

The Pursuit of Normal: Alerting on Anomalies using Splunk

It seems strange to talk about normal right now considering that, at the time of writing, a lot of the world is under quarantine. Yet in security, normal is something that is important to know. When creating alerts or analysing logs, you want to be notified when something is not