Ticket #39611

Vulnerability : Missing SPF

Eröffnet am: 2019-09-26 05:06 Letztes Update: 2020-06-01 11:40

Auswertung:
(del#102895)
Verantwortlicher:
Typ:
Status:
Geschlossen
Komponente:
Meilenstein:
(Keine)
Priorität:
5 - Mittel
Schweregrad:
5 - Mittel
Lösung:
Rejected
Datei:
Keine
Vote
Score: 0
No votes
0.0% (0/0)
0.0% (0/0)

Details

Hi,

I'm an independent cyber security researcher i have found multiple issues in your website.

Vulnerability : Missing SPF

I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim.

PoC:

<?php

$to = "VICTIM@example.com";

$subject = "Password Change";

$txt = "Change your password by visiting here - LINK HEREl";

$headers = "From: https://www.alidropstore.com/";

mail($to,$subject,$txt,$headers);

?>

The TXT records found for your domain are:

v=spf1 +ip4:202.221.179.0/24 ~all

Checking to see if there is a valid SPF record.

Found v=spf1 record for osdn.net: v=spf1 +ip4:202.221.179.0/24 ~all

Fix:

The TXT records found for your domain are:

v=spf1 +ip4:202.221.179.0/24 -all

Checking to see if there is a valid SPF record.

Found v=spf1 record for osdn.net: v=spf1 +ip4:202.221.179.0/24 -all

You can refer this https://www.digitalocean.com/community/tutorials/how-to-use-an-spf-record-to-prevent-spoofing-improve-e-mail-reliability

Let me know if any further info is required. Regards. Found More bugs on your website reply me so that i may disclose them further.

Ticket-Verlauf (2/2 Historien)

2019-09-26 05:06 Aktualisiert von: (del#102895)
  • New Ticket "Vulnerability : Missing SPF" created
2020-06-01 11:40 Aktualisiert von: ishikawa
  • Lösung Update from Keine to Rejected
  • Status Update from Offen to Geschlossen

Dateianhangliste

Keine Anhänge

Bearbeiten

You are not logged in. I you are not logged in, your comment will be treated as an anonymous post. » Anmelden