Description
Companies like Coinbase, Yahoo,Google,Facebook and even hackerone implemented a strict email security policy (combining SPF, DKIM, and DMARC) but I don't see that from support@amplenote.com, You should apply strict SMTP policy to stop spoofed email sending from yourdomain. POC is attached.
P.S : Make some protection because i can spoof your email so why not attacker do this ?
Exploit scenario(i just made a story but attacker can do anything) :
An attacker would send a Fake email from support@amplenote.com saying that Please change your password, The victim is aware of phishing attacks, But when he sees that the mail originated from support@amplenote.com He has no other way than to believe it. Clicking on the link takes him to a website where certain JavaScript is executed which steals his support@amplenote.com id and password (SESSION COOKIE).(If account knows your Login Panel) .The results can be more dangerous.
Code to Exploit:
<?php
$to = "VICTIM@example.com";
$subject = "Password Change";
$txt = "Change your password by visiting here - [VIRUS LINK HERE]l";
$headers = "amplenote.com";
mail($to,$subject,$txt,$headers);
?>
Found v=spf1 record for amplenote.com:
v=spf1 include:sendgrid.net include:mailgun.org include:_spf.google.com ~all
It Should be :
Found v=spf1 record for amplenote.com:
v=spf1 include:sendgrid.net include:mailgun.org include:_spf.google.com -all
Note : Google is using this ~ but google is also using external protection so no one spoof google email but in your case there is no consider a fake header and there is no protection and this - is also using facebook , twitter , hackerone also smile emoticon
Add your SPF with this Suggestion(if you have any suggestion then do it yourself) :
Strongly recommend you to read this article :
https:
The problem
The article clearly shows difference between softmail and fail you should be using fail as Softmail allows anyone to send spoofed emails from your domains. in your SPF record you should replace ~ with - at last before all , - is strict which prevents all spoofed emails except if you are sending. Your bug is that you are using~ , you should use - .