[icey]

> If you can identify a e-mail reflection vuln on the domain you can parlay that into a Slack invite

On reread, I realize that I'm not sure I understand what sort of attack you're talking about. While I think we've done a good job of making Abbot a safe entity, could you describe how this works? It's possible there's an attack vector we haven't considered. Thanks for sharing!

[xfitm3]

You need to know the Slack workspace URL, looks like the previous method I used to find this for arbitrary domains has been fixed. Workspace URLs aren't secret, though, and can often be guessed. Let's assume finding this for your target isn't an issue.

The most common reflection attack is through support systems, specifics will vary depending on the product used. Not all are vulnerable to this.

Open a support ticket with [e-mail] pretending to have a valid complaint. Obtain the unique e-mail address for your ticket such as [e-mail], and use "Sign up" at https://company.slack.com/signup#/domain-signup with the support ticket e-mail address.

The support ticket system can leak the contents of the Slack invitation as a ticket update. Once you know the validation URL Slack allows you to sign up.