Pentesting a leaked bot token

Telegram bot tokens turn up constantly on an engagement — hard-coded in a mobile or desktop app, committed to a repo, or sitting in a CI log, a config file, or a client-side bundle.

On its own a leaked token reads like a low-severity finding. Loading it into the dumper and the web viewer shows the real blast radius.

For an internal bot — a support desk, an IT/DevOps helper, an AI assistant — that history is every employee conversation with it: internal hostnames, VPN profiles, credentials, and infrastructure details, all browsable and searchable. That is what lets you scope the impact and evidence the finding in a report.

Web viewer showing the dump of an internal corporate bot

A fast triage flow

  1. Enumerate the users first — cheap, and it sizes the exposure:

    ./dumper.py --token TOKEN --down --users-csv --no-photos --no-media --no-history

    Read <bot_id>/users.csv to see who has talked to the bot.

  2. Full dump of what the token actually exposes:

    ./dumper.py --token TOKEN --down

  3. Browse and search the dump to find the sensitive material and screenshot it for the report:

    docker run --rm -p 127.0.0.1:8010:8010 -v "$PWD:/data" soxoj/telegram-bot-dumper-web

Warning

Only against a token you are authorized to assess. See the disclaimer on the front page.

Where tokens leak

A quick way to see the shape of the problem is a code search for common bot libraries, e.g. telepot.bot on GitHub.