E-Mail header Injection in HiFriend

[Peter Wiesen]

------------------------------------
-------Header Injection----------
------------------------------------

Script: hifriend.pl
Vendor: Hibyte
SoftwareVersion: The free one you get from many webpages
Dork: "hifriend.pl" + "cgi-bin"


------------------------------------
---------------Infos---------------
------------------------------------

This Exploit allows you to:

* send spam
* send fakemails
* E-Mail spoofing

Whit the google dork, you find a lot of pages using HiFriend.
A lot of Servers to send spam with.
Modify the source of the Exploit to change the message, your
spoofed e-mail, and the receiver.

Oh and you can send multiple mails!
Just put a comma behind a mail adress.


------------------------------------
--------------Exploit---------------
------------------------------------

http://perforin.dark-codez.com/Perl-Scripts/hifriend-xploit.txt


------------------------------------
---------Visit & Greetings--------
------------------------------------

www.DarK-CodeZ.com

Greetings to all my Friends ;)

_________________________________________________________________
Testen Sie Live.com - die schnelle, personalisierte Homepage, über die Sie auf alle für Sie relevanten Inhalte zentral zugreifen können.
http://www.live.com/getstarted

[Adrian Pastor]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I'm surprised that we don't see more of these issues being reported to
the public since they are relatively common.

There are MANY mailing scripts out there that allow malicious users to
abuse - otherwise not vulnerable to relay - mail servers for
spamming/phishing purposes.

For those interested in this topic I hope you find the following paper
and advisory educational:

http://www.procheckup.com/PDFs/auditing_mailing_scripts.pdf
http://www.procheckup.com/Vulnerability_PR07-21.php

Peter Wiesen wrote:
| ------------------------------------
| -------Header Injection----------
| ------------------------------------
|
| Script: hifriend.pl
| Vendor: Hibyte
| SoftwareVersion: The free one you get from many webpages
| Dork: "hifriend.pl" + "cgi-bin"
|
|
| ------------------------------------
| ---------------Infos---------------
| ------------------------------------
|
| This Exploit allows you to:
|
| * send spam
| * send fakemails
| * E-Mail spoofing
|
| Whit the google dork, you find a lot of pages using HiFriend.
| A lot of Servers to send spam with.
| Modify the source of the Exploit to change the message, your
| spoofed e-mail, and the receiver.
|
| Oh and you can send multiple mails!
| Just put a comma behind a mail adress.
|
|
| ------------------------------------
| --------------Exploit---------------
| ------------------------------------
|
| http://perforin.dark-codez.com/Perl-Scripts/hifriend-xploit.txt
|
|
| ------------------------------------
| ---------Visit & Greetings--------
| ------------------------------------
|
| www.DarK-CodeZ.com
|
| Greetings to all my Friends ;)
|
| _________________________________________________________________
| Testen Sie Live.com - die schnelle, personalisierte Homepage, über die
Sie auf alle für Sie relevanten Inhalte zentral zugreifen können.
| http://www.live.com/getstarted


- --
Adrian P. | Senior IT Security Consultant | ProCheckUp Ltd
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIjuOFUmN3xwbmU6YRAhMXAJ9q3ne577QQ/gOxUa1yrOhhCwo3pwCgvnbg
HMEmESO8uXRMES/pa3I7yrg=
=X/yw
-----END PGP SIGNATURE-----