bug report

[Mitesh Patil]

What Is SPF/TXT Records?

An SPF record is a type of Domain Name Service (DNS) record that identifies
which mail servers are permitted to send email on behalf of your domain.
The purpose of an SPF record is to prevent spammers from sending messages
with forged From addresses at your domain.
Checking Missing SPF:-
 There Are Various Ways of Checking Missing SPF Records on a website But
the Most Common and Popular way is kitterman.com

Steps to Check SPF Records on a website:-
Go to http://www.kitterman.com/spf/validate.html

Enter Target Website : pidgin.im
Hit Check SPF (IF ANY)

how to fix: verify the spf records again there is a error

If You seem any SPF Record than Domain is Not Vulnerable But if you see
Nothing Here then "HURRAY! You Found a Bug"

Attack Scenario & PoC:-
Once There is No SPF Records.An Attacker Can Spoof Email Via any Fake
Mailer Like Emkei.cz.An Attacker Can Send Email From name "Support" and
Email: "support at target.com" With Social Engineering Attack He Can TakeOver
User Account Let Victim Knows the Phishing Attack but When He See The Email
from the Authorized Domain.He Got tricked Easily.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20181012/1a2067e6/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot (480).png
Type: image/png
Size: 38308 bytes
Desc: not available
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20181012/1a2067e6/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot (478).png
Type: image/png
Size: 77022 bytes
Desc: not available
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20181012/1a2067e6/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot (479).png
Type: image/png
Size: 784487 bytes
Desc: not available
URL: <https://pidgin.im/cgi-bin/mailman/private/security/attachments/20181012/1a2067e6/attachment-0005.png>