![image](https://private-user-images.githubusercontent.com/38202442/267937960-a7a198da-0662-4daf-961a-2f3c7f60c6bb.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5Mzc5NjAtYTdhMTk4ZGEtMDY2Mi00ZGFmLTk2MWEtMmYzYzdmNjBjNmJiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYxN2UwNDU4ZWY4NjNiMGU2YTM5ODI4MDEyODRlN2M4ZjczNzQ0NzExN2M5YTRmNmMxYmQ4YzBmYzdhOTlkNzQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.2ye6mCeKQ4h8M7J9dkv1oKv_fc6rFTCu6hXfuUs0ncw)
![image](https://private-user-images.githubusercontent.com/38202442/267534121-8f4369fe-867f-4791-845e-38edf6104796.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc1MzQxMjEtOGY0MzY5ZmUtODY3Zi00NzkxLTg0NWUtMzhlZGY2MTA0Nzk2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTZlZWRjNzg2Mzk3MjlkMTBlNWQzYjA3NzZkOTlmMWNiMDE0NWFlNjg4MTBkYTRjY2JkN2YxODQ5YzI1Y2Y5ZTkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.mFg4gq0MD5wOiy3qotzOgIjhYmA2gtLQYBhSLf7nqO0)
期望是针对互联网各大API泄露的利用工具,包含钉钉、企业微信、飞书等。目前只做出了钉钉和企业微信,别问,就是懒。特别鸣谢chatgpt,代码好帮手。 目前界面长这样,布局拉胯,能用就行。
![image](https://private-user-images.githubusercontent.com/38202442/267281613-1b77da79-bcef-424e-a3f2-8d544696b2e3.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyODE2MTMtMWI3N2RhNzktYmNlZi00MjRlLWEzZjItOGQ1NDQ2OTZiMmUzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNjOTlhM2QyMzRmYjMwMDBlOGI3NGFmMzlkNzgxMWFhODNlODNhNDZlZjMzNmQwMzA0NTI4ODlhNzYwMGY3NmQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.NokGN0rJO4Afcc4Bvlc2PEGcpjFz6esEwTEztzEsgNo)
![image](https://private-user-images.githubusercontent.com/38202442/267688080-0ac3ba1a-b780-4515-9d41-a4eff9694506.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc2ODgwODAtMGFjM2JhMWEtYjc4MC00NTE1LTlkNDEtYTRlZmY5Njk0NTA2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTU0MDFmYmMxMzFiNjY2YzBiNzZhMzg0MmJlYjgyYWE4ZDhmNmFiZTJlZDdlMjIwYTEzOTA5ZmI2NjgwMDc2ZjgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.LKrcwQrwaIYjDaw61s04qtUrA_FNuNQ_eo7_0jWpgtY)
最简单的做法,直接填入有效手机号,加入组织中可以直接用手机号登录该企业。 userid不要重了,写大点。 删除按钮是根据userid来删除的
获取管理员信息,得到管理员userid。
查userid可以得到部门id dept_id,这里只做了对部门发公告,实际操作中针对个人发公告效果不如直接加用户钓鱼好使。
进一步可以发公告钓鱼
企业微信相对于钉钉,限制较多,22年后获取的应用Corpsecret需要设置白名单,且无法绕过。并且对于通讯录的Corpsecret需要单独获取。
![image](https://private-user-images.githubusercontent.com/38202442/267279462-a7531ef6-d7a3-4ad3-9441-c8f341d4f091.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzk0NjItYTc1MzFlZjYtZDdhMy00YWQzLTk0NDEtYzhmMzQxZDRmMDkxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ4NDlmN2M2ODQwMzEzYmMxMGEyMGFkNTRmMThkNjQ0ZDA3OGYxNjU3MTY5NjFkN2Q4OTYzN2RmMDY3YTUzNDAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.RlzwRlu7BKFXH593GGWWXZ1rV1D8mt2pF-_dMFlxeOg)
而且加进去就分配邮箱,可通过邮箱和企业微信钓鱼。
![image](https://private-user-images.githubusercontent.com/38202442/267277972-a6696792-4a83-4c1d-8997-260f99900a70.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzc5NzItYTY2OTY3OTItNGE4My00YzFkLTg5OTctMjYwZjk5OTAwYTcwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNhYjI5MDI3OGYzYjRlZGEwMzhlYWMwMGMyZjdhYWVmNmI3NTM4ZGZjYTM2NjAyMGM1OTA5ZjI3NWMwNmRjNDUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.RmnMEoZ9HhZvy15ruVet0hoLP6HiG-PEsdXGlBEGXzI)
![image](https://private-user-images.githubusercontent.com/38202442/267278072-cc60e6b7-177b-4c29-b0e9-4c26b8bee14d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzgwNzItY2M2MGU2YjctMTc3Yi00YzI5LWIwZTktNGMyNmI4YmVlMTRkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFiZWUxNzg5N2YyOGU5YzlhOGJkZTk0Njk1MWIxOGRjZjZhZDkxN2JhYTI4MjJkMDY4YWNlMzRiNzkyODhiNWQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.AvSpXbg1puvePXOTcmtGBBBnomMbd6Ll3no9Xj5yBBo)
![image](https://private-user-images.githubusercontent.com/38202442/267278373-a9203c39-14b2-4ee0-a2e4-6c4b59626893.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjcyNzgzNzMtYTkyMDNjMzktMTRiMi00ZWUwLWEyZTQtNmM0YjU5NjI2ODkzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTk5ZTlhZjZmZDM3NThkZDliMjFkNmEwM2RhNDcwODNmOWM3YjE5OTYxOWNjNmQ0MDZiMzdlNmFlNWQ3MTQ3MDEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.w7wjlMLEyOC5UVMKOz-_-4bHHs2yTBuacd93NCyRXrE)
实际利用的较少,一般都是劫持cookie做钓鱼用。
需要注意,open_department_id为查询到的部门id,用户默认是放根部门,比较明显。可以放小部门里。
![image](https://private-user-images.githubusercontent.com/38202442/267940075-e6ca4650-d93c-4c5f-b087-7e2ea880f18c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5NDAwNzUtZTZjYTQ2NTAtZDkzYy00YzVmLWIwODctN2UyZWE4ODBmMThjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTM1M2E2YWIxNjI4Zjg0OWY5MWM2YWQ2NjYwYTkwNzc0NTRiOWNmYTc0NDkzNmQxOTM0Mjg0ODBiZDk0ZjEwYTAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.mYqNjh-ghfHFqPfc2ow3DtN59vEOjD0hUXKgK_8QkX0)
![image](https://private-user-images.githubusercontent.com/38202442/267939569-90e2b5f4-535e-4ead-a526-6d18d4b4d5ee.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjM4ODk5MzgsIm5iZiI6MTcyMzg4OTYzOCwicGF0aCI6Ii8zODIwMjQ0Mi8yNjc5Mzk1NjktOTBlMmI1ZjQtNTM1ZS00ZWFkLWE1MjYtNmQxOGQ0YjRkNWVlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MTclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODE3VDEwMTM1OFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTEzNDQyZTVlYTJmZGFkMGMwZjg1N2E5MGRhMDExNGVmMjJhZjBmMGZhYWVlYzJiYjdhYzNlOTFlY2FhOTk1ZGImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.df1x-xYCHkYlGEu2s13FMR9uf2tsY5epp1B6OdDjBtw)