![image](https://private-user-images.githubusercontent.com/38202442/267937960-a7a198da-0662-4daf-961a-2f3c7f60c6bb.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5Mzc5NjAtYTdhMTk4ZGEtMDY2Mi00ZGFmLTk2MWEtMmYzYzdmNjBjNmJiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTZjZjAwM2M3MDQ1YjRhMzMzNjNjNjM2MTA0OWQ2YWRjMzJlMWM2ZDUyZDA0NDRlODBlZDgwOWRhMjkwYWI2ZDUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.FJ459QTj056nVpGDNv9Oebd9xCtqqlr68NrBBsyslqU)
![image](https://private-user-images.githubusercontent.com/38202442/267534121-8f4369fe-867f-4791-845e-38edf6104796.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc1MzQxMjEtOGY0MzY5ZmUtODY3Zi00NzkxLTg0NWUtMzhlZGY2MTA0Nzk2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE0M2M5YjE2YzQ5NGQ5YjFjZWM5ZWQzZDYzYjg5OWIxMWRmZjdjZGI5Y2YyMGY3YzcxZjdlZGU0ZjFjZmE2NTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.I8lgIly5SAGTlrS0gZpc_byp9fCkew8N1iDpgwtjlGY)
期望是针对互联网各大API泄露的利用工具,包含钉钉、企业微信、飞书等。目前只做出了钉钉和企业微信,别问,就是懒。特别鸣谢chatgpt,代码好帮手。 目前界面长这样,布局拉胯,能用就行。
![image](https://private-user-images.githubusercontent.com/38202442/267281613-1b77da79-bcef-424e-a3f2-8d544696b2e3.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyODE2MTMtMWI3N2RhNzktYmNlZi00MjRlLWEzZjItOGQ1NDQ2OTZiMmUzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTRkYWYzNjdjYzBhMmUwMDNkMDZhZDZkNmQwNmM0OTZlNWMxOTdiNzBmNWE2NjExMWI3YmU2YzBmY2M0MDRiYTQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.64ieV34QBPzkExwo7wTk2A_CJmlUisPNGW_4EWeco98)
![image](https://private-user-images.githubusercontent.com/38202442/267688080-0ac3ba1a-b780-4515-9d41-a4eff9694506.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc2ODgwODAtMGFjM2JhMWEtYjc4MC00NTE1LTlkNDEtYTRlZmY5Njk0NTA2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTk4NmIzZGI2ZGZiMDk4MDBlMWMxYzNmZDc3MWVhYTdkZGE5MjkwYzRjZDU3MDY0MjE4YmNmOTY3MGE5YjUwYmImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.3Kj3nErAxx2MsWOdbVngUgmIRiaieZ82xuD_On8w4-c)
最简单的做法,直接填入有效手机号,加入组织中可以直接用手机号登录该企业。 userid不要重了,写大点。 删除按钮是根据userid来删除的
获取管理员信息,得到管理员userid。
查userid可以得到部门id dept_id,这里只做了对部门发公告,实际操作中针对个人发公告效果不如直接加用户钓鱼好使。
进一步可以发公告钓鱼
企业微信相对于钉钉,限制较多,22年后获取的应用Corpsecret需要设置白名单,且无法绕过。并且对于通讯录的Corpsecret需要单独获取。
![image](https://private-user-images.githubusercontent.com/38202442/267279462-a7531ef6-d7a3-4ad3-9441-c8f341d4f091.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzk0NjItYTc1MzFlZjYtZDdhMy00YWQzLTk0NDEtYzhmMzQxZDRmMDkxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYxNzg2YmIxZjU3YWM3NTM0YzZkMTZiYzRiNTYzYzdlMDBkZGE3ODk4YmQwYWY4ZTUxODdlMWM2ZThkMzk4YTcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.1K9AnYYyFnqmQ-pm1uPZGXr42YCCF91Qpupd6Iivb4Q)
而且加进去就分配邮箱,可通过邮箱和企业微信钓鱼。
![image](https://private-user-images.githubusercontent.com/38202442/267277972-a6696792-4a83-4c1d-8997-260f99900a70.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzc5NzItYTY2OTY3OTItNGE4My00YzFkLTg5OTctMjYwZjk5OTAwYTcwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVhNDQ2ODc0ZjExNzFjY2FiMzFlYmYxODEzOWUzMmU2ZTBmYzU3MWE0MmNjODljMzZmMjI2Y2IyZTQ5M2VmMDYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.VEoYnO0gdJ57P6MQemjwiS2IFBKcedbabAENiP2sO-I)
![image](https://private-user-images.githubusercontent.com/38202442/267278072-cc60e6b7-177b-4c29-b0e9-4c26b8bee14d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzgwNzItY2M2MGU2YjctMTc3Yi00YzI5LWIwZTktNGMyNmI4YmVlMTRkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNlZjJkZmE0ZjljMzBjYmQ5Mjc2NGU0NTZjODM2MWQ5MTY5ZTU1OTNlNGFmMmZhNzllN2JjNzVlZDc0ZjVkYWQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.G2HmT_8GIDc7KPCrmabwji_4gaFIA112TDSL2Aoyyus)
![image](https://private-user-images.githubusercontent.com/38202442/267278373-a9203c39-14b2-4ee0-a2e4-6c4b59626893.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzgzNzMtYTkyMDNjMzktMTRiMi00ZWUwLWEyZTQtNmM0YjU5NjI2ODkzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTllYTUzYjY3YzQ0YTg0YWRlNDMzNWY5MzhmMGE3NzQxODU2MmNmODAyMjE3OWQwYzE1ZDZkZGMwYzI5NGQ4ODAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.KqjsRjvb9FMTAEK6O3x1W34h0Enxjm74rRZ95c07xdU)
实际利用的较少,一般都是劫持cookie做钓鱼用。
需要注意,open_department_id为查询到的部门id,用户默认是放根部门,比较明显。可以放小部门里。
![image](https://private-user-images.githubusercontent.com/38202442/267940075-e6ca4650-d93c-4c5f-b087-7e2ea880f18c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5NDAwNzUtZTZjYTQ2NTAtZDkzYy00YzVmLWIwODctN2UyZWE4ODBmMThjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTNjODE5NTk4MDdjNmViYWQ2MmExMjMzNzQyMTg1M2YyMTAyYzdkNzNkYWVlOTE2OTkyMzc3YjZmNDc1NDBiMmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.4n6o6yXrkuY5uW73FIBhXv9JjFPsuQGHwErCsk0rUts)
![image](https://private-user-images.githubusercontent.com/38202442/267939569-90e2b5f4-535e-4ead-a526-6d18d4b4d5ee.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDc0MDEsIm5iZiI6MTcyNDgwNzEwMSwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5Mzk1NjktOTBlMmI1ZjQtNTM1ZS00ZWFkLWE1MjYtNmQxOGQ0YjRkNWVlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAxMDUwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTkzODE3OTkyZDA5YzczYjU5YzdjMDFiMTI2MjAyNTI5OTRiMjI5ZWY1NzRiOTA2NjZmZmRkMDIyYzlkNWUyNjEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.YHfozanGKdUkNsKj8togdh1SZNgEjnXU36prhchRwdY)