Sublime Security low experimental mql

Open redirect: Slack

Message contains use of Slack's open redirect but the sender is not Slack.

View Source

Detection Logic

type.inbound
and 0 < length(body.links) < 10
and sender.email.domain.root_domain not in~ (
  'atlassian.net',
  'slack.com',
  'soundtrap.com'
)
and any(body.links,
        .href_url.domain.domain == 'slack-redir.net'
        and strings.ilike(.href_url.query_params, '*url=*')
)

Field Validations

Loading…

Comments (0)

Loading comments...