grthtrhthjhtyjytjytkergtrhtrjytjerhrfh4:24 29/09/2026Return-Path: Received: from adriana.servidorlinux11.com by adriana.servidorlinux11.com with LMTP id iCnwCHPgfV8rMCsASxZWHQ (envelope-from ); Wed, 07 Oct 2020 12:36:19 -0300 Return-path: Envelope-to: contact@zoe-uruguay.com Delivery-date: Wed, 07 Oct 2020 12:36:19 -0300 Received: from mail-io1-f65.google.com ([209.85.166.65]:35579) by adriana.servidorlinux11.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1kQBUI-00BwvE-Ct for contact@zoe-uruguay.com; Wed, 07 Oct 2020 12:36:19 -0300 Received: by mail-io1-f65.google.com with SMTP id k6so2823587ior.2 for ; Wed, 07 Oct 2020 08:35:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=PcyQZ2R0vTCOaMEMxq/BOxSPnay3paaL1LkKmPCVu0Q=; b=i7ER9UOj+pbBwCHrXqOmVES0VkA23P4GPWwUxFIanmGWlW05rVnUwE3s/BjIQ4+1Cq zGtYf1hGEhohdqVLI49lKVtPbZkIVdzuqv3aO2COCHvCj1lNf42bUApIGiKyC+SNggvE o4yJgroJhSoPIL8QLgxapxIP7mBPuGvnT4ER7w9kL0nqKxK9gDS1yiAlK/6eNQwvGb6P D5HwspLi9jXtWnqLGR575MC4JzzCgH9t36s2Yof9G72gqBZ0fm+amt+TA3TZqDFi8nFJ pOWUrqdtgtofAr+Ut+ES/thEAJe14Bp10Lvkc2nGo9ai9pCKc3XBR7Elua1LzQ/xmEzY u2SA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=PcyQZ2R0vTCOaMEMxq/BOxSPnay3paaL1LkKmPCVu0Q=; b=VehKDCv1azb5P5TsHUYYHUUJaOn7uDg8XByshYWXs22Dq0eIZI+ooRV6FqxVtgzoRz wD+L6Wg9UCJY4hoyTI8Onq17EKkR8bQDE1m/KR6pjlazW2ICwKVW02TXggGFOupPNxmo NHBiM8MCc8wThd7almSvggxkc5s26MAbwGVcCsrc5+jlRob5I1JmNR01O37JwA3emioV fjPNjHkbW99YGcRZlPrY0lVR7wPOCZ1kMLwkPsxfdYPknyJRgz4w+pTze61FBeXFD95S A/0+sylgX/x5rDZr9Dy6cJjxg4F4nI8oFUe2zhKdvonQDFOX/zsoeWnVaavCQWEFD8Yo 4cIA== X-Gm-Message-State: AOAM532KcsqNP2xFx2gnZOWaf95B7R64gY2bH3qv8n4Yt6beRtH1vNIr +ITv8FzC/FfrzD3C0UezgGj17KaahK1XvMbA39yChrMBuRhVSA== X-Google-Smtp-Source: ABdhPJwZ8KTeCGkN5qzy9xJNzmEhba3uj8dv4PyRX0Krrd3vHhjvSKkbcrEeIE4JWKqB476fl56zbjFSDVvxtJK6QDQ= X-Received: by 2002:a6b:db06:: with SMTP id t6mr2773571ioc.204.1602084937356; Wed, 07 Oct 2020 08:35:37 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Meer Ramzan Date: Wed, 7 Oct 2020 20:35:24 +0500 Message-ID: Subject: Re: Bug Report To: contact@zoe-uruguay.com Content-Type: multipart/alternative; boundary="00000000000097587005b1167755" X-Spam-Status: No, score=0.9 X-Spam-Score: 9 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "adriana.servidorlinux11.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Hi Team, I am still waiting for your response. Can you please let me know about the reported bug? And I am hoping to receive a reward for the responsible disclosure of the vulnerability. Kind Regards, Content analysis details: (0.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.5000] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [meerramzan199[at]gmail.com] 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit [meerramzan199[at]gmail.com] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 HTML_MESSAGE BODY: HTML included in message -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-Spam-Flag: NO --00000000000097587005b1167755 Content-Type: text/plain; charset="UTF-8" Hi Team, I am still waiting for your response. Can you please let me know about the reported bug? And I am hoping to receive a reward for the responsible disclosure of the vulnerability. Kind Regards, On Sat, 19 Sep 2020 at 22:35, Meer Ramzan wrote: > Hello Team , > > > > I am a security researcher and I founded this vulnerability in your > website. > > I just sent a forged email to my email that appears to originate from > contact@zoe-uruguay.com > . I was able to do this because of the following DMARC record: > > > > DMARC record lookup and validation for your website > > "No DMARC Record found" > > > > Fix: > > 1)Publish DMARC Record. > > 2)Enable DMARC Quarantine/Reject policy > > 3)Your DMARC record should look like > > "v=DMARC1; p=reject; pct=100; ri=86400; rua=mailto:info@domain.com" > > > > This is useful in phishing, and this type of vulnerability is newsworthy ( > http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was-used-to-attack-coinbase-a-bitcoin-exchange/ > ). > > > > This can be done using any php mailer tool like this , > > > $to = "VICTIM@example.com"; > > $subject = "Password Change"; > > $txt = "Change your password by visiting here - [VIRUS LINK HERE]l"; > > $headers = "From: > contact@zoe-uruguay.com > > "; > > mail($to,$subject,$txt,$headers); > > > > ?> > > > > You can check your DMARC record form here : > https://mxtoolbox.com/SuperTool.aspx > > > > Reference : > https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkim-dmarc_records > > > > Let me know if you need me to send another forged email, or if you have > any other questions. > > > I hope to receive reward for the responsible disclosure of the > vulnerability > > > Thanks, > > Regards > --00000000000097587005b1167755 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Team,
I am still waiting for your response.
Can y= ou please let me know about the reported bug?
And I am hoping to receive= a reward for the responsible disclosure of the vulnerability.

Kind= Regards,

On Sat, 19 Sep 2020 at 22:35, Meer Ramzan <meerramzan199@gmail.com> wrote:
=

Hello Team ,

=C2=A0

I am a security researcher and I founded this vulnerability in your webs= ite.

I just sent a forged e= mail to my email=C2=A0that appears to originate from=C2=A0

contact@zoe-uruguay.com

<= /td>

. I was able to do t= his because of the following DMARC record:

=C2=A0

DMA= RC record lookup and validation for your website

"No DMARC Record found"

=C2=A0

Fix:

1)Publish DMA= RC Record.

2)Enable DMARC Q= uarantine/Reject policy

3)Y= our DMARC record should look like

"v=3DDMARC1; p=3Dreject; pct=3D100; ri=3D86400; rua=3Dmailto:info@domain.com"= ;

=C2=A0

This is useful in phishing, and this type of = vulnerability is newsworthy (http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email= -breach-was-used-to-attack-coinbase-a-bitcoin-exchange/).

=C2=A0

This can be done using any php mailer tool like this ,

=

<?php

$to =3D "VICTIM@example.com";

$subject =3D "Password Change";

$txt =3D "Change your password= by visiting here - [VIRUS LINK HERE]l";

$headers =3D "From:=C2=A0

<= h3 style=3D"overflow:hidden;white-space:nowrap;font-size:0.75rem;font-weigh= t:inherit;margin:inherit;text-overflow:ellipsis;font-family:Roboto,RobotoDr= aft,Helvetica,Arial,sans-serif;letter-spacing:0.3px;color:rgb(95,99,104);li= ne-height:20px">

= contact@zoe-ur= uguay.com

<= td style=3D"display:flex">

<= table cellpadding=3D"0" style=3D"border-collapse:collapse;margin-top:0px;wi= dth:auto;font-size:14px;letter-spacing:0.2px;display:block;color:rgb(34,34,= 34);white-space:normal">

mail($to,$subject= ,$txt,$headers);

=C2=A0

=

?>

=C2=A0

You can check your DMARC record form here :=C2=A0https://mxtoolbox.com/SuperToo= l.aspx

=C2=A0

Reference :=C2=A0https://www.knownhost.com/wiki/email/troubleshooting= /setting-up_spf-dkim-dmarc_records

=C2=A0

Let me k= now if you need me to send another forged email, or if you have any other q= uestions.


I hope to receive reward for the respo= nsible disclosure of the vulnerability=C2=A0


Than= ks,

Regards

--00000000000097587005b1167755--