Slack Watchman is a tool that uses the Slack API to detect exposed secrets and enumerate sensitive workspace information for security teams.
Slack enumeration and exposed secrets detection tool
Slack Watchman is primarily used by red, blue, and purple teams to monitor Slack workspaces for exposed secrets such as API keys, tokens, and sensitive personal or financial data. It helps security professionals identify and remediate potential leaks and misconfigurations in Slack environments by providing detailed enumeration and time-based searching capabilities.
Slack Watchman requires Slack API tokens for authenticated scans to detect secrets and enumerate detailed workspace data. Use the --probe flag for limited unauthenticated enumeration. Regularly update signatures to maintain detection accuracy. Be mindful of privacy and compliance when scanning workspaces.
Ensure Python 2.7 or 3.x is installed
Install Slack Watchman via pip: pip install slack-watchman
Optionally configure watchman.conf for tokens, URLs, and disabled signaturesslack-watchman --probe https://domain.slack.com
Run Slack Watchman in unauthenticated probe mode to enumerate workspace metadata and authentication options without requiring a token.