Security June 2021

security@internal.sparta.eu

1 participants
4 discussions

by Sakshi Patil

Vulnerability Name: DMARC RECORD MISSING Vulnerable URL:https://www.sparta.eu/ HOW TO REPRODUCE(POC-ATTACHED):- 1.GO TO- https://mxtoolbox.com/ 2.ENTER THE WEBSITE(sparta.eu). CLICK GO. 3.YOU WILL SEE THE FAULT(No DMARC Record found). 4.In the new page that loads change MXLookup to DMARCLookup. Extra information Impact: Spammers can forge the "From" address on email messages to make messages appear to come from someone in your domain. If spammers use your domain to send spam or junk email, your domain quality is negatively affected. People who get the forged emails can mark them as spam or junk, which can impact authentic messages sent from your domain. Attachment:

2 years, 8 months

(Bug Report)No valid SPF record.

by Sakshi Patil

Vulnerability Name:No valid SPF record. DESCRIPTION: An SPF record is a type of Domain Name Service (DNS) record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF record is to prevent spammers from sending messages with forged From addresses at your domain. Vulnerable Domain :sparta.eu Steps To Reproduce: 1) Checking Missing SPF: There Are Various Ways of Checking Missing SPF Records on a website But the Most Common and Popular way is kitterman.com Steps to Check SPF Records on a website:- Go to http://www.kitterman.com/spf/validate.html Enter Target Website Ex:sparta.eu (Do Not Add https/http or www)Hit Check SPF (IF ANY) If You seem any SPF Record than Domain is Not Vulnerable But if you see no SPF record here,it is vulnerable 2) Attack Scenario & Poc: Once There is No SPF Records.An Attacker Can Spoof Email Via any Fake Mailer Like Emkei.cz.An <http://emkei.cz.an/> Attacker Can Send Email From name "Security" and Email: "security(a)target.com" With Social Engineering Attack He Can TakeOver User Account Let Victim Knows the Phishing Attack but When He See The Email from the Authorized Domain.He Got tricked Easily. Exploit: For testing i am forgering support(a)sparta.eu How to reproduce this 1.Go to https://emkei.cz/ 2. Fill all the details like Name - support sparta email - support(a)sparta.eu to - my email address etc send email 3. It will directly send a mail from support(a)sparta.eu to my email Impact : Attacker can use official mail for phishing attack. which can be used for phishing attack. At it is from official mail, user will definitely trust it and will be tricked in phishing trap. Attachment:

2 years, 10 months

(Bug Report)Click jacking.

by Sakshi Patil

*Vulnerability Name : Click jacking* Target URL:https://www.sparta.eu/ Vulnerability Description : Click jacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. The server didn't return an X-Frame-Options header which means that this website could be at risk of a click jacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid click jacking attacks, by ensuring that their content is not embedded into other sites. Typically there is one type of attack - cross site request forgeries (CSRF) that can interact with functions on other websites. 1) This vulnerability affects Web Server. <html> <head> <title>Clickjack test page</title> </head> <style> #myBtn{ z-index: 999; position: absolute; top: 100px; right: 50px; color: white; background-color: red; } </style> <body>  <div style="z-index:-9999; position:absolute;top:0; left:0;width: 70%; height:70%"> <iframe src="https://www.sparta.eu/ "frame1" width="100%" height="100%" > </iframe></div> <div align="right" style="position:absolute; top:1; left:0; z-index:1; width: 70%;height:60%; text-align:left;"> <a href="https://www.sparta.eu/ "target="_blank"><button id="myBtn"> click here</button></a>  <div id="myModal" class="modal">  </div> </body> </html> 2.save it as <any name>.html eg s.html 3.and just simply open that..and click on button(direct login) its redirect https://www.sparta.eu/ As far as i know this data is enough to prove that your site is vulnerable to Click jacking. Impact: Attacker may tricked user, sending them malicious link then user open it clicked some image and their account unconsciously has been deactivated . Attachment:

2 years, 10 months

Security vulnerability report :- Server Security Misconfiguration Clickjacking Vulnerability

by Shivam Pravin Khambe

Hello, SiR / Madam, sparta.eu Security Support Team, My Name Is* SHIVAM KHAMBE* From India. I Am *Security** Researcher's* *I Am Found Clickjacking Vulnerability ,* Your website deals with security issues. What is Click Jacking Vulnerability ? 1.Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. 2.The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. Server-side methods – the most common is X-Frame-Options. Server-side methods are recommended by security experts as an effective way to defend against clickjacking. This vulnerability affects Web Server. The Vulnerable Domain Is :- https://sparta.eu/ Step to Reproduce :- 1 :- I have given Expolit as follows. 2 :- Copy it to a Notepad copy and Past it Save as .html file 3 :- And double-click that file and open a new tab on the browser Expolit :- <html> <head> <title>Clickjack test page</title> </head> <body> <p><font size="5" color="#bf0000"> Website is vulnerable to clickjacking! 500x500</font></p> <iframe src="https://sparta.eu/" width="500" height="500"></iframe> </body> </html> Impact: *By using Clickjacking technique, an attacker hijack's click'smeant for one page and route them to another page, most likelyfor another application, domain, or both.* *REFERENCE Suggestions :* https://owasp.org/www-community/attacks/Clickjacking *# Everything is shown in the POC in a quick way ... *Best Regards,*

4 years, 3 months

2025

2024

2023

2022

2021

2020

2019

Security June 2021