Bug Report

[Shubham Maheshwari]

SPF/TXT Records

An SPF record is a type of Domain Name Service (DNS) record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF record is to prevent spammers from sending messages with forged From addresses at your domain.

Checking Missing SPF:-
 There Are Various Ways of Checking Missing SPF Records on a website But the Most Common and Popular way is kitterman.com

Steps to Check SPF Records on a website:-
Go to http://www.kitterman.com/spf/validate.html

Enter Target Website pidgin.im

If You seem any SPF Record than Domain is Not Vulnerable But if you see Nothing Here then "HURRAY! You Found a Bug"
 
Attack Scenario & PoC:-

Once There is No SPF Records.

An Attacker Can Spoof Email Via any Fake Mailer Like anonymousemail.me

Attacker Can Send Email From name "Support" and Email: "support at pidgin.im" With Social Engineering Attack He Can TakeOver User Account 

Let Victim Knows the Phishing Attack but When He See The Email from the Authorized Domain.

He Got tricked Easily. 

	


POC :

Video File is attached.








-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20180221/b7ca2f80/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pidgin.im.mp4
Type: video/mp4
Size: 3276084 bytes
Desc: not available
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20180221/b7ca2f80/attachment-0001.mp4>