grthtrhthjhtyjytjytkergtrhtrjytjerhrfh4:24 29/09/2026Return-Path: Received: from adriana.servidorlinux11.com by adriana.servidorlinux11.com with LMTP id aAwwOFkE0V/G6ywASxZWHQ (envelope-from ); Wed, 09 Dec 2020 14:07:37 -0300 Return-path: Envelope-to: contact@zoe-uruguay.com Delivery-date: Wed, 09 Dec 2020 14:07:37 -0300 Received: from mail-ot1-f45.google.com ([209.85.210.45]:39868) by adriana.servidorlinux11.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1kn2wD-00COsB-DU for contact@zoe-uruguay.com; Wed, 09 Dec 2020 14:07:37 -0300 Received: by mail-ot1-f45.google.com with SMTP id d8so2051992otq.6 for ; Wed, 09 Dec 2020 09:07:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=zbSBTc3k59damSw2gJN18JKPkJg+okYH3sCMzUbc/2U=; b=g1zfkVW5EFNYRRZjBo3BBYiR/B5m4cO7IMhY7ulrlXWaHBev7nLA5fI37JRektZ5tK 1Q39sfwg5Z6wQhqe5gJfoH0LdTL5bZBuOAz25wIGQpChPQaQH/LvYlQBinkCjbYNzQhg 310ScxDcnnQQU3WOlYOR3AMzUrmUCDpSNdQKy91kXZ7PIgRbKQuGVgUI+VysVHMyIG9C M6IiKXxFA2rbL1QUDhojNbaDeu+0yHG+HOQxIx+hzqdKMzPSqV4q28BsuKVeYYq076lI RG9ScEzHk+yOGJ64K0eQstarR0JPZ9ztT5zNafMjL2cyAjMuQffVvxL41k5dsVL/2zon 7B9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=zbSBTc3k59damSw2gJN18JKPkJg+okYH3sCMzUbc/2U=; b=OFCxkKRatYvVGuf4NCZyewlj55LrZDw76zLi5CUBnabM+7ErA50bXsqnn300uTwfFL 82sief4jp6et4laWjxlpRJVQ4au6koNn71Di8p/omTTB/OnYDIJ0aWcp8zPQZ9t7witv UPKI7fvL4dOVYNZPpg6JIbArxf2sxQTnVI5FbLmMtlE7v9H0XhKnR7jNovnLST8+I/Gi wdE7s/sbX2LK0bNmmLZLidfKEPcM582xv6yQBHVNYh956gzx3rZN+C/1ldJywBYHUwsH 3jq7W36xAchOUs6po+3KKtTZmJG1qgQ4g0whYdTh2jjL3nsCY/a79mzLP6iiMHc+NjOX aVCA== X-Gm-Message-State: AOAM533XP42qdc+/1X5kzYucGhNmOr6Qns3qjf44ukzzC16hHcNpR133 qqeoph8Q6Hd3aCqR72kdU/yQ94vuY+jAbJThqPRKtesU6k+oPfmM X-Google-Smtp-Source: ABdhPJyVhJ5KVYcNfoROzxGXHWys4FMX0FJOzgDsd7vyOzE0zCdlrrzHy6yLiHKmFYM3sLthTQWl7MIBdiJefbipXGM= X-Received: by 2002:a9d:7ac2:: with SMTP id m2mr2590814otn.41.1607533616259; Wed, 09 Dec 2020 09:06:56 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: kashif shoukat Date: Wed, 9 Dec 2020 22:06:44 +0500 Message-ID: Subject: Re: Bug Report To: contact@zoe-uruguay.com Content-Type: multipart/alternative; boundary="00000000000029667205b60b161e" X-Spam-Status: No, score=0.9 X-Spam-Score: 9 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "adriana.servidorlinux11.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Hello Team Hope you are well Can you please let me know about the reported bug? Content analysis details: (0.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.5000] 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit [shoukatkashif7[at]gmail.com] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [shoukatkashif7[at]gmail.com] 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-Spam-Flag: NO --00000000000029667205b60b161e Content-Type: text/plain; charset="UTF-8" Hello Team Hope you are well Can you please let me know about the reported bug? It's been a long time since I shared this issue, but I have not received a response from you. I hope to receive a reward/service fee for the found a bug in your website and send it to you ethically And can I post this report on my blog for study purposes this week? waiting for your response. Kind Regards On Sun, Aug 30, 2020 at 10:14 PM kashif shoukat wrote: > Hi there, > > I am waiting for your email. > Would you be able to please tell me about the reported vulnerability? > And I am hoping to receive a reward for the reported issue. > > Kind Regards, > > On Sun, Aug 23, 2020 at 8:57 PM kashif shoukat > wrote: > >> Hello Team , >> >> >> >> I am a security researcher and I founded this vulnerability in your >> website. >> >> I just sent a forged email to my email that appears to originate from >> contact@zoe-uruguay.com >> . I was able to do this because of the following DMARC record: >> >> >> >> DMARC record lookup and validation for your website >> >> "No DMARC Record found" >> >> >> >> Fix: >> >> 1)Publish DMARC Record. >> >> 2)Enable DMARC Quarantine/Reject policy >> >> 3)Your DMARC record should look like >> >> "v=DMARC1; p=reject; pct=100; ri=86400; rua=mailto:info@domain.com" >> >> >> >> This is useful in phishing, and this type of vulnerability is newsworthy ( >> http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was-used-to-attack-coinbase-a-bitcoin-exchange/ >> ). >> >> >> >> This can be done using any php mailer tool like this , >> >> > >> $to = "VICTIM@example.com"; >> >> $subject = "Password Change"; >> >> $txt = "Change your password by visiting here - [VIRUS LINK HERE]l"; >> >> $headers = "From: >> contact@zoe-uruguay.com >> >> "; >> >> mail($to,$subject,$txt,$headers); >> >> >> >> ?> >> >> >> >> You can check your DMARC record form here : >> https://mxtoolbox.com/SuperTool.aspx >> >> >> >> Reference : >> https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkim-dmarc_records >> >> >> >> Let me know if you need me to send another forged email, or if you have >> any other questions. >> >> >> I hope to receive reward for the responsible disclosure of the >> vulnerability >> >> >> Thanks, >> >> Regards >> > --00000000000029667205b60b161e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello Team

Hope you are well

Can you please = let me know about the reported bug?

It's been a long time since= I shared this issue, but I have not received a response from you.

I= hope to receive a reward/service fee for the found a bug in your website a= nd send it to you ethically
And can I post this report on my blog for st= udy purposes this week?

waiting for your response.

Kind Regar= ds

On Sun, Aug 30, 2020 at 10:14 PM kashif shoukat <shoukatkashif7@gmail.com> wrote:
Hi there,<= br>
I am waiting for your email.
Would you be able to please tell me= about the reported vulnerability?
And I am hoping to receive a reward f= or the reported issue.

Kind Regards,

On Sun, Aug 23, 2020 at 8:5= 7 PM kashif shoukat <shoukatkashif7@gmail.com> wrote:

Hello Team ,

=C2=A0

I am a secu= rity researcher and I founded this vulnerability in your website.

I just sent a forged email to my ema= il=C2=A0that appears to originate from=C2=A0

<= /tbody>

contact@zoe-uruguay.com=

. I was able to do this because= of the following DMARC record:

=C2=A0

DMARC record l= ookup and validation for your website

"No DMARC Record found"

=C2=A0

Fi= x:

1)Publish DMARC Record.<= /p>

2)Enable DMARC Quarantine/R= eject policy

3)Your DMARC r= ecord should look like

&quo= t;v=3DDMARC1; p=3Dreject; pct=3D100; ri=3D86400; rua=3Dmailto:info@domain.com"

=C2=A0

This is useful in phishing, and this type of vulnerabili= ty is newsworthy (http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was= -used-to-attack-coinbase-a-bitcoin-exchange/).

=C2=A0

This can be done using any php mailer tool like this ,

<?php

$to =3D "VICTIM@example.com";

$subject =3D "Password Change";

$txt =3D "Change your password by visiting = here - [VIRUS LINK HERE]l";

$headers =3D "From:=C2=A0

contact@= zoe-uruguay.com

=

";

mail($to,$subject,$txt,$head= ers);

=C2=A0

?>

=C2=A0

You can= check your DMARC record form here :=C2=A0https://mxtoolbox.com/SuperTool.aspx<= /p>

=C2=A0

Reference :=C2=A0https://www.knownhost.com/wiki/email/troubleshooting/setting-up= _spf-dkim-dmarc_records

=C2=A0

Let me know if you = need me to send another forged email, or if you have any other questions.


I hope to receive reward for the responsible discl= osure of the vulnerability=C2=A0


Thanks,

Regards

<