News for hackers. Stuff that matters.

A comment on PHPMailer Exploit – Remote Code Execution. Parent comment

Re:PHPMailer Exploit – Remote Code Execution by annnnd on Wednesday December 28, 2016 @05:30AM (#13269676)
Genuinly curious: does '+' trick work? I would imagine any infringing parties would learn to remove plus sign and all after it before selling the database of addresses by now...

Other than that: true, I hate incorrect validation. But I hate sloppy security practices even more.

[ Parent | on HN ]
Re:PHPMailer Exploit – Remote Code Execution by thaumaturgy on Wednesday December 28, 2016 @05:43AM (#13269713)
Not as much as it used to. You're right, they've caught on to it. I need to stand up another mail server pretty soon, I want to try making it easy to generate random recipient aliases, so e.g. [email protected] is an alias for [email protected] and [email protected] is an alias for [email protected]. That oughtta stump 'em for a while.
[ Parent | on HN ]