grthtrhthjhtyjytjytkergtrhtrjytjerhrfh4:24 29/09/2026Return-Path: Received: from adriana.servidorlinux11.com by adriana.servidorlinux11.com with LMTP id QB9BCq3eS19NEykASxZWHQ (envelope-from ); Sun, 30 Aug 2020 14:15:25 -0300 Return-path: Envelope-to: contact@zoe-uruguay.com Delivery-date: Sun, 30 Aug 2020 14:15:25 -0300 Received: from mail-ot1-f54.google.com ([209.85.210.54]:40688) by adriana.servidorlinux11.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1kCQvM-00BK26-GX for contact@zoe-uruguay.com; Sun, 30 Aug 2020 14:15:25 -0300 Received: by mail-ot1-f54.google.com with SMTP id e23so3435795otk.7 for ; Sun, 30 Aug 2020 10:15:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=TKj7JWSlUvYdozj89GdgEmJgHRgFymmKWC+pCRqIxJw=; b=hUPB/vL8XPJ5sI5Wd24DS4moqFDNS5YVbf+Z1MoPBW2rbvyOcysoDjNSqo7/W9xDLo 0o8rQjeqVOFTETSE4arpKCV8hy1WkyRZwjCnGnBnspRTLLqQPGFvKpwSOIRSHI9tL68Y OxM3zYAt3jU97YAqnQYmi/zQwqD9W/fm0mGSis016IEvNXPEwudwHUlrhKsYhOGUdGCk F1d16oxEdRkhwhbSP1MfLr2KQHEexVVwZdAoafDyRWwAnSRkAd/yjbGLtHXM+6C+avhB VaQh776HsNp6sT8KvHfwKc6u4yz3WC+oJCHKsPlu9ci4gTHSfUZPd8PDSIrcNYFa/KYC dKPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=TKj7JWSlUvYdozj89GdgEmJgHRgFymmKWC+pCRqIxJw=; b=nq/PxbM+pmyUl3s8F8JdaM+oexuCPum5Np+OOedx+y8cqO21rIWpm0Pohnto7KIri/ SR8So/x/Tk2PUEfFgBLDwDsxnSw0vkGZCDwuIdpuf6e/irk5HiNdVT+rcnA84SHOkXHZ DJu6v1rwhJmbpWL4K0DdIkAy0kGGz0d/6/Onj1zLevdsrc/M5MsIkp3+2/WpSZaiP09w vVYmEUGlm9rn02T4Y17Lgx68Bp6n1O2xbXAqMKbme44MqygHdGIkmcw/4q5525ewHv0d Ef7EbpB1UW6LWdTShqDlyQrW1/syJVgVffm/SWeeFlYo4wssWrOg2iV9Ulv22amZyeyF TNIw== X-Gm-Message-State: AOAM533/slsg8IinzEEB2CkcTo+0utCtonZTxwow8WXPPU7Ro7mkyZGy w593jmFrxmM/fzIaNf+rYMiARuDn5DDB6iaSJM3q6Sugong+yQ== X-Google-Smtp-Source: ABdhPJy7N0WBXVYP1sxRIY76crrQcUVWCPmLnzcU9l/i9aDoKm4tbHt3npgfQphbYsocbPWZPE7hlhwwtiy7tH30JZs= X-Received: by 2002:a9d:24c6:: with SMTP id z64mr2209642ota.97.1598807683722; Sun, 30 Aug 2020 10:14:43 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: kashif shoukat Date: Sun, 30 Aug 2020 22:14:30 +0500 Message-ID: Subject: Re: Bug Report To: contact@zoe-uruguay.com Content-Type: multipart/alternative; boundary="0000000000000d714105ae1b6ced" X-Spam-Status: No, score=0.8 X-Spam-Score: 8 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "adriana.servidorlinux11.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Hi there, I am waiting for your email. Would you be able to please tell me about the reported vulnerability? And I am hoping to receive a reward for the reported issue. Kind Regards, Content analysis details: (0.8 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [209.85.210.54 listed in wl.mailspike.net] 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.5000] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [shoukatkashif7[at]gmail.com] -0.0 SPF_PASS SPF: sender matches SPF record 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit [shoukatkashif7[at]gmail.com] 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-Spam-Flag: NO --0000000000000d714105ae1b6ced Content-Type: text/plain; charset="UTF-8" Hi there, I am waiting for your email. Would you be able to please tell me about the reported vulnerability? And I am hoping to receive a reward for the reported issue. Kind Regards, On Sun, Aug 23, 2020 at 8:57 PM kashif shoukat wrote: > Hello Team , > > > > I am a security researcher and I founded this vulnerability in your > website. > > I just sent a forged email to my email that appears to originate from > contact@zoe-uruguay.com > . I was able to do this because of the following DMARC record: > > > > DMARC record lookup and validation for your website > > "No DMARC Record found" > > > > Fix: > > 1)Publish DMARC Record. > > 2)Enable DMARC Quarantine/Reject policy > > 3)Your DMARC record should look like > > "v=DMARC1; p=reject; pct=100; ri=86400; rua=mailto:info@domain.com" > > > > This is useful in phishing, and this type of vulnerability is newsworthy ( > http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was-used-to-attack-coinbase-a-bitcoin-exchange/ > ). > > > > This can be done using any php mailer tool like this , > > > $to = "VICTIM@example.com"; > > $subject = "Password Change"; > > $txt = "Change your password by visiting here - [VIRUS LINK HERE]l"; > > $headers = "From: > contact@zoe-uruguay.com > > "; > > mail($to,$subject,$txt,$headers); > > > > ?> > > > > You can check your DMARC record form here : > https://mxtoolbox.com/SuperTool.aspx > > > > Reference : > https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkim-dmarc_records > > > > Let me know if you need me to send another forged email, or if you have > any other questions. > > > I hope to receive reward for the responsible disclosure of the > vulnerability > > > Thanks, > > Regards > --0000000000000d714105ae1b6ced Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi there,

I am waiting for your email.
Would yo= u be able to please tell me about the reported vulnerability?
And I am h= oping to receive a reward for the reported issue.

Kind Regards,
=

= On Sun, Aug 23, 2020 at 8:57 PM kashif shoukat <shoukatkashif7@gmail.com> wrote:

Hello Team ,

=C2=A0

I a= m a security researcher and I founded this vulnerability in your website.

I just sent a forged email t= o my email=C2=A0that appears to originate from=C2=A0

=

contact@zoe-urugua= y.com

. I was able to do thi= s because of the following DMARC record:

=C2=A0

DMA= RC record lookup and validation for your website

"No DMARC Record found"

=C2=A0

Fix:

1)Publish DMA= RC Record.

2)Enable DMARC Q= uarantine/Reject policy

3)Y= our DMARC record should look like

"v=3DDMARC1; p=3Dreject; pct=3D100; ri=3D86400; rua=3Dmailto:info@domain.com"= ;

=C2=A0

This is useful in phishing, and this type of = vulnerability is newsworthy (http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email= -breach-was-used-to-attack-coinbase-a-bitcoin-exchange/).

=C2=A0

This can be done using any php mailer tool like this ,

=

<?php

$to =3D "VICTIM@example.com";

$subject =3D "Password Change";

$txt =3D "Change your password= by visiting here - [VIRUS LINK HERE]l";

$headers =3D "From:=C2=A0

contact@zoe-uruguay.com

";

mail($to,$subje= ct,$txt,$headers);

=C2=A0

?>

=C2=A0

You can check your DMARC record form here :=C2=A0https://mxtoolbox.com/SuperT= ool.aspx

=C2=A0

Reference :=C2=A0https://www.knownhost.com/wiki/email/troubleshooti= ng/setting-up_spf-dkim-dmarc_records

=C2=A0

Let me= know if you need me to send another forged email, or if you have any other= questions.


I hope to receive reward for the resp= onsible disclosure of the vulnerability=C2=A0


Tha= nks,

Regards

<