Re: E-Mail header Injection in HiFriend

[Adrian Pastor <adrian.pastor () procheckup com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I'm surprised that we don't see more of these issues being reported to
the public since they are relatively common.

There are MANY mailing scripts out there that allow malicious users to
abuse - otherwise not vulnerable to relay - mail servers for
spamming/phishing purposes.

For those interested in this topic I hope you find the following paper
and advisory educational:

http://www.procheckup.com/PDFs/auditing_mailing_scripts.pdf
http://www.procheckup.com/Vulnerability_PR07-21.php

Peter Wiesen wrote:
| ------------------------------------
| -------Header Injection----------
| ------------------------------------
|
| Script: hifriend.pl
| Vendor: Hibyte
| SoftwareVersion: The free one you get from many webpages
| Dork: "hifriend.pl" + "cgi-bin"
|
|
| ------------------------------------
| ---------------Infos---------------
| ------------------------------------
|
| This Exploit allows you to:
|
| * send spam
| * send fakemails
| * E-Mail spoofing
|
| Whit the google dork, you find a lot of pages using HiFriend.
| A lot of Servers to send spam with.
| Modify the source of the Exploit to change the message, your
| spoofed e-mail, and the receiver.
|
| Oh and you can send multiple mails!
| Just put a comma behind a mail adress.
|
|
| ------------------------------------
| --------------Exploit---------------
| ------------------------------------
|
| http://perforin.dark-codez.com/Perl-Scripts/hifriend-xploit.txt
|
|
| ------------------------------------
| ---------Visit & Greetings--------
| ------------------------------------
|
| www.DarK-CodeZ.com
|
| Greetings to all my Friends ;)
|
| _________________________________________________________________
| Testen Sie Live.com - die schnelle, personalisierte Homepage, über die
Sie auf alle für Sie relevanten Inhalte zentral zugreifen können.
| http://www.live.com/getstarted


- --
Adrian P. | Senior IT Security Consultant | ProCheckUp Ltd
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIjuOFUmN3xwbmU6YRAhMXAJ9q3ne577QQ/gOxUa1yrOhhCwo3pwCgvnbg
HMEmESO8uXRMES/pa3I7yrg=
=X/yw
-----END PGP SIGNATURE-----