VulnerabilityPublished 17 Sep 2025

Practical guide for hunters: how leaked webhooks are abused and how to defend them

Source Reddit NetSec

Severity

Medium

Rated by Threat Radar

Data as of 17 Sep 2025, 12:37 UTC

What to do

AI-suggested

European organizations should implement multi-layered defenses for webhook security beyond simply keeping URLs secret. Specific recommendations include: 1) Enforce strict HMAC signature verification on all incoming webhook requests using a shared secret, ensuring the payload integrity and authenticity; 2) Implement nonce or timestamp checks to prevent replay attacks; 3) Use allowlists for source IP addresses where feasible to restrict webhook senders; 4) Design webhook receivers to validate payload content rigorously and implement business logic checks to prevent unauthorized actions; 5) Rotate webhook URLs and secrets periodically and immediately upon suspicion of leakage; 6) Employ monitoring and alerting via SIEM tools to detect anomalous webhook activity, such as unexpected payloads or traffic spikes; 7) Educate development and operations teams about the risks of webhook leakage and secure coding practices; 8) Avoid embedding sensitive data in webhook URLs or payloads; 9) Use separate webhook endpoints with minimal privileges for different integration purposes to limit blast radius; 10) Conduct regular security reviews and penetration testing focused on webhook implementations. These measures collectively reduce the risk of abuse and improve detection capabilities.

Description

I wrote a hands on guide that shows how leaked webhooks surface as an attack vector; how to find them in the wild; how to craft safe non destructive PoCs; how to harden receivers. Includes curl examples for Slack and Discord; Node.js and Go HMAC verification samples; a disclosure template. Why this matters * webhooks are often treated as bearer secrets; leaks are common * small mistakes in verification or ordering can become business logic bugs * many real world impacts are serviceable without flashy RCE What you get in the post * threat model and scope guidance * detection rules and SIEM ideas Read it here: [https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/](https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/) Notes: do not test endpoints you do not own.follow program scope and responsible disclosure rules. Happy hunting

Impact

For European organizations, the abuse of leaked webhooks can lead to unauthorized data injection, manipulation of business processes, and potential service disruptions. Since webhooks are widely used in collaboration platforms (e.g., Slack, Discord) and internal automation pipelines, exploitation could compromise confidentiality by exposing sensitive data sent via webhook payloads, integrity by altering data or triggering unintended workflows, and availability by overwhelming services or triggering destructive actions. The absence of flashy RCE does not diminish the threat, as business logic flaws can cause significant operational and reputational damage. Organizations relying heavily on SaaS integrations and automated workflows are particularly at risk. Furthermore, compliance with GDPR and other data protection regulations means that unauthorized data access or manipulation via webhook abuse could lead to regulatory penalties. The threat is exacerbated by the common practice of treating webhook URLs as bearer tokens without additional authentication or verification, increasing the attack surface. Detection and response can be challenging due to the subtlety of such attacks and the difficulty in distinguishing legitimate from malicious webhook traffic without proper logging and monitoring.

Summary

This security threat centers around the abuse of leaked webhooks, which are commonly used to enable communication between services by sending real-time data to specified URLs. Webhooks often function as bearer tokens, meaning possession of the webhook URL alone can grant an attacker the ability to send arbitrary data to the receiving service. The guide referenced provides a practical approach to identifying leaked webhooks in the wild, crafting safe proof-of-concept (PoC) exploits that avoid destructive outcomes, and hardening webhook receivers against abuse. Key technical points include the common failure to properly verify webhook payloads, such as neglecting to validate HMAC signatures or mishandling the order of verification steps, which can lead to business logic vulnerabilities even without direct remote code execution (RCE). The guide includes examples using curl for Slack and Discord webhooks and sample code in Node.js and Go for HMAC verification, illustrating how attackers might exploit these weaknesses. It also offers detection strategies, including SIEM rules to identify suspicious webhook activity. Although no known exploits are currently active in the wild, the threat is significant because leaked webhooks are a frequent occurrence and can be leveraged for unauthorized actions, data manipulation, or service disruption. The threat model emphasizes that even small mistakes in webhook security can have outsized impacts, and the guide advocates responsible disclosure and ethical testing practices.

References

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 17 Sep 2025, 12:37 UTC

Technical details

References

Community reviews

Related threats