You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
8
-
9
-
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
10
-
11
-
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
12
-
13
-
-**Join the**[**💬**](https://emojipedia.org/speech-balloon/)[**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter**[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
-**Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
7
+
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
8
+
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
9
+
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
10
+
***Join the**[**💬**](https://emojipedia.org/speech-balloon/)[**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter**[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
11
+
***Share your hacking tricks by submitting PRs to the**[**hacktricks repo**](https://github.com/carlospolop/hacktricks)**and**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
16
12
17
13
</details>
18
14
15
+
##
19
16
20
-
# Payloads
21
-
22
-
## Ignored parts of an email
23
-
24
-
The symbols: **+, -** and **{}** in rare occasions can be used for tagging and ignored by most e-mail servers
You can also use IPs as domain named between square brackets:
41
-
42
-
* john.doe@\[127.0.0.1]
43
-
* john.doe@\[IPv6:2001:db8::1]
44
-
45
-
## Other vulns
46
-
47
-
.png>)
48
-
49
-
# Third party SSO
50
-
51
-
## XSS
52
-
53
-
Some services like **github** or **salesforce allows** you to create an **email address with XSS payloads on it**. If you can **use this providers to login on other services** and this services **aren't sanitising** correctly the email, you could cause **XSS**.
54
-
55
-
## Account-Takeover
56
-
57
-
If a **SSO service** allows you to **create an account without verifying the given email address** (like **salesforce**) and then you can use that account to **login in a different service** that **trusts** salesforce, you could access any account.\
58
-
_Note that salesforce indicates if the given email was or not verified but so the application should take into account this info._
59
-
60
-
# Reply-To
61
-
62
-
You can send an email using _**From: company.com**_**** and _**Replay-To: attacker.com**_ and if any **automatic reply** is sent due to the email was sent **from** an **internal address** the **attacker** may be able to **receive** that **response**.
Some applications like AWS have a **Hard Bounce Rate** (in AWS is 10%), that whenever is overloaded the email service is blocked.
71
-
72
-
A **hard bounce** is an **email** that couldn’t be delivered for some permanent reasons. Maybe the **email’s** a fake address, maybe the **email** domain isn’t a real domain, or maybe the **email** recipient’s server won’t accept **emails**) , that means from total of 1000 emails if 100 of them were fake or were invalid that caused all of them to bounce, **AWS SES** will block your service.
73
-
74
-
So, if you are able to **send mails (maybe invitations) from the web application to any email address, you could provoke this block by sending hundreds of invitations to nonexistent users and domains: Email service DoS.**
- Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
82
-
83
-
- Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
- Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
86
-
87
-
-**Join the**[**💬**](https://emojipedia.org/speech-balloon/)[**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter**[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
88
-
89
-
-**Share your hacking tricks by submitting PRs to the[hacktricks repo](https://github.com/carlospolop/hacktricks) and[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
23
+
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
24
+
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
25
+
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
26
+
***Join the**[**💬**](https://emojipedia.org/speech-balloon/)[**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter**[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
27
+
***Share your hacking tricks by submitting PRs to the**[**hacktricks repo**](https://github.com/carlospolop/hacktricks)**and**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
> **However, don’t forget that the EIGRP routing domain can be protected by authentication. But you still have a chance to connect to the routing domain. When hello packets are sent out, they also contain cryptographic hashes. If you can extract these hashes from the traffic dump and reset the password, you can log on to the routing domain with this password.**
71
71
@@ -97,7 +97,7 @@ During the establishment and maintenance of the neighborhood between EIGRP route
Thus, after establishing the neighborhood, we know about the existence of these subnets, which makes it easier for us to pentest and save time. We can do without additional subnet scanning. Now we are in the EIGRP routing domain and we can develop some attack vectors. Let’s talk about them.
You also need to specify the path to the dictionary in order to bruteforce the encrypted key. Be sure to uncheck the **Use Bruteforce** option, otherwise Loki will bruteforce the password without using the dictionary.
45
45
@@ -61,7 +61,7 @@ Great, we managed to unlock the key, now we need to decrypt the TACACS traffic.
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
16
16
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
17
17
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
18
18
***Join the**[**💬**](https://emojipedia.org/speech-balloon/)[**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter**[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
19
-
***Share your hacking tricks by submitting PRs to the[hacktricks repo](https://github.com/carlospolop/hacktricks) and[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
19
+
***Share your hacking tricks by submitting PRs to the**[**hacktricks repo**](https://github.com/carlospolop/hacktricks)**and**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
@@ -70,7 +72,7 @@ Function [ <internal:standard> function mail ] {
70
72
}
71
73
```
72
74
73
-
### The 5th parameter ($additional\_parameters)
75
+
#### The 5th parameter ($additional\_parameters)
74
76
75
77
This section is going to be based on **how to abuse this parameter supposing that an attacker controls it**.
76
78
@@ -90,20 +92,76 @@ Here are a few examples of different man pages of sendmail command/interface:
90
92
91
93
Depending on the **origin of the sendmail** binary different options have been discovered to abuse them and l**eak files or even execute arbitrary commands**. Check how in [**https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html**](https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html)
92
94
95
+
## Inject in the e-mail name
96
+
97
+
### Ignored parts of an email
98
+
99
+
The symbols: **+, -** and **{}**in rare occasions can be used for tagging and ignored by most e-mail servers
You can also use IPs as domain named between square brackets:
118
+
119
+
* john.doe@\[127.0.0.1]
120
+
* john.doe@\[IPv6:2001:db8::1]
121
+
122
+
### Other vulns
123
+
124
+
.png>)
125
+
126
+
## Third party SSO
127
+
128
+
### XSS
129
+
130
+
Some services like **github** or **salesforce allows** you to create an **email address with XSS payloads on it**. If you can **use this providers to login on other services** and this services **aren't sanitising** correctly the email, you could cause **XSS**.
131
+
132
+
### Account-Takeover
133
+
134
+
If a **SSO service** allows you to **create an account without verifying the given email address** (like **salesforce**) and then you can use that account to **login in a different service** that **trusts** salesforce, you could access any account.\
135
+
_Note that salesforce indicates if the given email was or not verified but so the application should take into account this info._
136
+
137
+
## Reply-To
138
+
139
+
You can send an email using _**From: company.com**_\*\* \*\* and _**Replay-To: attacker.com**_ and if any **automatic reply** is sent due to the email was sent **from** an **internal address** the **attacker** may be able to **receive** that **response**.
140
+
141
+
## Hard Bounce Rate
142
+
143
+
Some applications like AWS have a **Hard Bounce Rate** (in AWS is 10%), that whenever is overloaded the email service is blocked.
144
+
145
+
A **hard bounce** is an **email** that couldn’t be delivered for some permanent reasons. Maybe the **email’s** a fake address, maybe the **email** domain isn’t a real domain, or maybe the **email** recipient’s server won’t accept **emails**) , that means from total of 1000 emails if 100 of them were fake or were invalid that caused all of them to bounce, **AWS SES** will block your service.
146
+
147
+
So, if you are able to **send mails (maybe invitations) from the web application to any email address, you could provoke this block by sending hundreds of invitations to nonexistent users and domains: Email service DoS.**
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
103
161
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
104
162
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
105
163
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
106
-
***Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
164
+
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
0 commit comments