Bug Report

[Richard Laager]

The lack of an SPF record isn’t a big deal. We may add one, if for no other reason than so people quit bothering us about it.

-- 
Richard

> On Feb 21, 2018, at 09:36, Shubham Maheshwari <shubhamgilda319 at gmail.com> wrote:
> 
> SPF/TXT Records
>  
> An SPF record is a type of Domain Name Service (DNS) record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF record is to prevent spammers from sending messages with forged From addresses at your domain.
>  
> Checking Missing SPF:-
> There Are Various Ways of Checking Missing SPF Records on a website But the Most Common and Popular way is kitterman.com
>  
> Steps to Check SPF Records on a website:-
> Go to http://www.kitterman.com/spf/validate.html
>  
> Enter Target Website pidgin.im
>  
> If You seem any SPF Record than Domain is Not Vulnerable But if you see Nothing Here then "HURRAY! You Found a Bug"
> Attack Scenario & PoC:-
>  
> Once There is No SPF Records.
>  
> An Attacker Can Spoof Email Via any Fake Mailer Like anonymousemail.me
>  
> Attacker Can Send Email From name "Support" and Email: "support at pidgin.im" With Social Engineering Attack He Can TakeOver User Account
>  
> Let Victim Knows the Phishing Attack but When He See The Email from the Authorized Domain.
>  
> He Got tricked Easily.
>  
>              
>  
>  
> POC :
>  
> Video File is attached.
>  
>  
>  
>  
>  
>  
>  
>  
> <pidgin.im.mp4>
> _______________________________________________
> security mailing list
> security at pidgin.im
> https://pidgin.im/cgi-bin/mailman/listinfo/security
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20180222/7d43c567/attachment.html>