- Notifications
You must be signed in to change notification settings - Fork2
A demo showing how to harvest credentials from Zapier
License
NotificationsYou must be signed in to change notification settings
mbrg/zapcreds
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
ZapCreds is a recon tool that harvests credentials from Zapier.
Given a Zapier user, ZapCreds will scan every Zapier account the user has access to and will retrieve private connections owned by this user and shared connections the user has access to.
Disclaimer: these materials are presented from an attacker’s perspective with the goal of raising awareness to the risks of underestimating the security impact of No Code/Low Code. No Code/Low Code is awesome.
| account_name | app_name | app_icon | connection_created | connection_title | connection_owner |
|---|---|---|---|---|---|
| Marketing | Dropbox |  | 2021-06-06T10:54:52Z | Dropboxjohnw@gmail.com | John.Webb@mycompany.com |
| Marketing | Gmail |  | 2021-06-06T10:00:14Z | GmailBobby.Atkinson@mycompany.com | Bobby.Atkinson@mycompany.com |
| Marketing | Gmail | | 2021-06-06T07:53:42Z | GmailLola.Burton@mycompany.com #2 | Lola.Burton@mycompany.com |
| Marketing | Google Calendar |  | 2022-01-25T21:08:48Z | Google Calendarjohnw@gmail.com | John.Webb@mycompany.co |
| Marketing | Google Drive |  | 2022-01-26T11:10:41Z | Google DriveBobby.Atkinson@mycompany.com | Bobby.Atkinson@mycompany.com |
| SalesOps | Google Sheets |  | 2022-02-20T09:20:15Z | Google SheetsSariah.Cote@mycompany.com | Sariah.Cote@mycompany.com |
| SalesOps | OneNote |  | 2022-03-03T09:18:36Z | OneNotegibsonm@outlook.com #2 | Mia.Gibson@mycompany.com |
git clone https://github.com/mbrg/zapcreds# use python>=3.6python -m pip install.
Command line
zapcreds --email John.Webb@mycompany.com --password password -out found_creds.csv
Python
importrequestsfromzapcreds.harvestimportauthenticate_session,get_credentialssession=requests.Session()authenticate_session(session,"John.Webb@mycompany.com","password")creds=get_credentials(session)print(creds.columns)# Index(['account_name', 'account_owner', 'app_name', 'app_version', 'app_icon', 'connection_created', 'connection_title', 'connection_description', 'connection_owner'],
Pull requests and issues are always welcome.
About
A demo showing how to harvest credentials from Zapier