Skip to content

Discord Webhook URL

Service Name: Discord

Service Description: Discord is a VoIP and instant messaging social platform that allows users to communicate via voice calls, video calls, text messaging, and media files in private chats or as part of communities called "servers".

Service Address: https://discord.com/

Validation Type: API Auth

IP Allow list: Does not exist at the webhook level, but Discord offers IP whitelisting for verified bots and OAuth2 applications.

Secret Access Scope: Grants the ability to post messages to a specific Discord channel without authentication. Anyone with the webhook URL can send messages to the associated channel.

Secret Revokement URL: https://discord.com/channels/[server_id]/[channel_id]/integrations

Secret Example: https://discord.com/api/webhooks/1234567890123456789/abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz

Suspicious Activity Investigation Instructions:

  • Check the Discord channel for unexpected or unauthorized messages.
  • Review the webhook's recent activity in the Discord server's audit logs.
  • Examine the content of suspicious messages for potential phishing links or malicious content.
  • Verify if the webhook is being used from unexpected IP addresses or locations.
  • Check if the frequency of webhook usage aligns with expected patterns.

Mitigation Instructions:

  • Delete the compromised webhook in Discord server settings:
  • Go to Server Settings > Integrations > Webhooks
  • Find the affected webhook and click "Delete"
  • Create a new webhook with a different URL if the integration is still needed.
  • Review permissions for who can create and manage webhooks in your server.
  • Consider implementing a rate limit for webhook usage if available.
  • Monitor the new webhook for any suspicious activity.
  • If the webhook was used to post malicious content, delete those messages from the channel.