bugtraq - Re: E-Mail header Injection in HiFriend

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 29 Jul 2008 10:31:49 +0100
From: Adrian Pastor <adrian.pastor@...checkup.com>
To: bugtraq@...urityfocus.com
Cc: Peter Wiesen <broken-error@...mail.com>
Subject: Re: E-Mail header Injection in HiFriend

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I'm surprised that we don't see more of these issues being reported to
the public since they are relatively common.

There are MANY mailing scripts out there that allow malicious users to
abuse - otherwise not vulnerable to relay - mail servers for
spamming/phishing purposes.

For those interested in this topic I hope you find the following paper
and advisory educational:

http://www.procheckup.com/PDFs/auditing_mailing_scripts.pdf
http://www.procheckup.com/Vulnerability_PR07-21.php

Peter Wiesen wrote:
| ------------------------------------
| -------Header Injection----------
| ------------------------------------
|
| Script: hifriend.pl
| Vendor: Hibyte
| SoftwareVersion: The free one you get from many webpages
| Dork: "hifriend.pl" + "cgi-bin"
|
|
| ------------------------------------
| ---------------Infos---------------
| ------------------------------------
|
| This Exploit allows you to:
|
| * send spam
| * send fakemails
| * E-Mail spoofing
|
| Whit the google dork, you find a lot of pages using HiFriend.
| A lot of Servers to send spam with.
| Modify the source of the Exploit to change the message, your
| spoofed e-mail, and the receiver.
|
| Oh and you can send multiple mails!
| Just put a comma behind a mail adress.
|
|
| ------------------------------------
| --------------Exploit---------------
| ------------------------------------
|
| http://perforin.dark-codez.com/Perl-Scripts/hifriend-xploit.txt
|
|
| ------------------------------------
| ---------Visit & Greetings--------
| ------------------------------------
|
| www.DarK-CodeZ.com
|
| Greetings to all my Friends ;)
|
| _________________________________________________________________
| Testen Sie Live.com - die schnelle, personalisierte Homepage, über die
Sie auf alle für Sie relevanten Inhalte zentral zugreifen können.
| http://www.live.com/getstarted


- --
Adrian P. | Senior IT Security Consultant | ProCheckUp Ltd
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIjuOFUmN3xwbmU6YRAhMXAJ9q3ne577QQ/gOxUa1yrOhhCwo3pwCgvnbg
HMEmESO8uXRMES/pa3I7yrg=
=X/yw
-----END PGP SIGNATURE-----