RE: Mail Server problem / query

From: Joe_Wulf (Joe_Wulf_at_yahoo.com)
Date: 04/14/05

  • Next message: Rod S: "Netcat through Squid HTTP Proxy" 
    To: <pen-test@securityfocus.com>
Date: Thu, 14 Apr 2005 09:58:45 -0400

    Depends on the type you are doing. Check out 'qmail' and 'exim'.
    They definately have configurable options to allow/prevent, thus
    manage exactly what you are talking about. You didn't mention
    the type of mail server you are testing---that might have helped.
     
    R,
    -Joe Wulf, CISSP
     ProSync Technology Group, LLC
     www.prosync.com
     Senior IA Engineer

    -----Original Message-----
    From: Marc Davison [mailto:m_davison@talk21.com]
    Sent: Wednesday, April 13, 2005 17:45
    To: pen-test@securityfocus.com
    Subject: Mail Server problem / query

    Hi all, I hope you can help with this. I have been testing a server for
    open-relay and found that I could connect from an external machine and send
    mails using a MAIL FROM (the local domain) and a RCPT TO (the local domain) -
    now this may seem fine as internal users will need to send mail to other
    internal users but my query is whether there are mail servers which can be
    configured to recognise that the connection was an external address and
    therefore that the MAIL FROM address was invalid. eg I can send a mail from the
    CEO of the company to his own secretary asking her to copy his hotmail address
    on all future mails and to the secretary, this mail seems perfectly valid yet me
    (prospective attacker) outside the comapany may now receive loads of sensitive
    mails (assuming the secretary is the type who doesn't like to query things and
    ask questions) - thanks in advance.

    Send instant messages to your online friends http://uk.messenger.yahoo.com

  • Next message: Rod S: "Netcat through Squid HTTP Proxy"

    Relevant Pages

    • Re: Query a DNS in C
      ... #> I want to query a DNS within a C program to get the mail server ... If your job was as meaningless as theirs, ...
      (comp.unix.programmer)
    • Re: How can I validate a given e-mail address?
      ... There's no way to query that mail server, ... whether it bounces back to you. ... Many domains do not respond to non-existent addresses ...
      (comp.lang.java.programmer)
    • SQL Server to MS-Exchange Mail Server
      ... Is there a way to have SQL Server2000 query an MS-Exchange ... Mail server ... There is an OLE DB Provider for Outlook Search driver, ...
      (microsoft.public.sqlserver.server)
    • Re: DNS on DC and problem with MX entrie
      ... If I query this DNS about mail server I don't get response. ...
      (microsoft.public.win2000.active_directory)