Re:PHPMailer Exploit – Remote Code Execution
by adjkant on Wednesday December 28, 2016 @04:05AM
(#13269391)
I somehow went through life not knowing the + trick. Thanks, and commenting to hopefully highlight this for anyone else who didn't know.
[ Parent
| on HN ]
Re:PHPMailer Exploit – Remote Code Execution
by thaumaturgy on Wednesday December 28, 2016 @04:32AM
(#13269483)
The specific character depends on your MTA configuration. In Postfix this is the recipient_delimiter setting. I went with a "+" because that's the same character Gmail uses. Other mail services may not support this feature. Hope this helps!