You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To get the flag, send your postfix configuration in `/etc/postfix/main.cf` to a PoC Security administrator.</br>
36
-
You can send it in `workshop-spoofing@proton.me` with your Epitech email addres with the following subject: `SMTP server`.</br>
39
+
You can send it in `workshop-spoofing@proton.me` with your Epitech email address with the following subject: `SMTP server`.</br>
37
40
38
41
If you have not received the flag after 5 minutes, please contact a PoC Security member.
39
42
@@ -56,28 +59,52 @@ The subject is the same that the previous step but the content must be original
56
59
It must contain the PoC logo and the text must be colored.</br>
57
60
You're free to put whatever you want in the email.</br>
58
61
59
-
> Hint: think how to embeded html code in the email.
62
+
> 💡 Hint: think how to embed html code in the email.
60
63
61
64
## Step 4: Evil Proxy
62
65
The evil proxy will be able to intercept all the traffic and redirect it to a server of your choice.</br>
63
-
In our case, the proxy will redirect all the traffic to the PoC Innovation github url: `https://github.com/PoCInnovation` </br>
66
+
In our case, the proxy will redirect all the traffic to the PoC Innovation github url: [https://github.com/PoCInnovation](https://github.com/PoCInnovation) </br>
64
67
Before redirect, it must implement a login page to get the admin password.</br>
I recommand to use [EvilGinx2](https://github.com/kgretzky/evilginx2) to create the evil proxy and [Freenom](https://www.freenom.com/en/index.html?lang=en) to get a free domain name.</br>
74
+
We recommend to use [EvilGinx2](https://github.com/kgretzky/evilginx2) to create the evil proxy and [Freenom](https://www.freenom.com/en/index.html?lang=en) to get a free domain name.</br>
72
75
To get the flag, you will have to send the same spoofing email that the previous step with the evil proxy url.</br>
73
76
74
77
## Step 5: Go Further
78
+
75
79
You must have seen that spoofing does not work on all mailboxes because of bad certificates used. </br>
76
80
Indeed, some providers check if the certificates match the dns record of the email used. </br>
77
81
If you want to go further, you can try to spoof an email with a good certificate to bypass restrictions.</br>
78
82
79
83
All bonus in this workshop will be rewarded in the PoC Security platform.</br>
80
84
Don't hesitate to contact a staff member if you have any questions :) </br>
0 commit comments