Read the notesEmail me
Menu

N1NJ10 Notes

Phishing

Resources

Commands

  • Local SMTP [Evasive]
    • Postfix 
      # Configuer PTR record [VPS]
# Configure TXT SPF Record [Domain]
	# A @ record with VPS IP
	# A mail. record with VPS IP 
apt-get update # regular update 
export DEBIAN_FRONTEND=noninteractive # don't shows questions 
echo "postfix postfix/main_mailer_type select No configuration" | debconf-set-selections # Don't creat auto configs 
apt-get install -y postfix mailutils swaks opendkim opendkim-tools # install my tools 
cp /usr/share/postfix/main.cf.dist /etc/postfix/main.cf # just ensure it copies 
 
postconf -e 'myhostname = mail.fadymoheb.com' # Sets the server's FQDN (Fully Qualified Domain Name)
postconf -e 'mydomain = fadymoheb.com' # Used as a variable for other settings.
postconf -e 'myorigin = $mydomain' # Sets the domain appended to local sender addresses insted of [email protected] to [email protected] 
postconf -e 'mydestination =' # do not accept mail for any local domain.
postconf -e 'mynetworks = 127.0.0.0/8' # Only trusts the loopback interface , Only programs running on this same machine can send mail through me without a password.
postconf -e 'inet_interfaces = 127.0.0.1' # Postfix listens ONLY on localhost
postconf -e 'inet_protocols = ipv4' # Disable IPv6 
postconf -e 'relayhost =' # will look up the recipient's MX record via DNS and connect directly to their mail server.
postconf -e 'smtp_tls_security_level = may' #  try to use TLS if the remote server supports it. it has none never use TLS , may use TLS if available , encrypt require TOLS 
postconf -e 'smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination' # open-relay prevention rule one only 127.0.0.1 
postconf -e 'disable_vrfy_command = yes' # Disables the VRFY SMTP command.
postconf -e 'message_size_limit = 15360000' # Max email size 15 Mib 
postconf -e 'default_transport_rate_delay = 15s' # Wait 15s between every email and other 
postconf -e 'initial_destination_concurrency = 1' # One email per thread 
postconf -e 'default_destination_concurrency_limit = 1' # only one destenation thread per connection 
postconf -e 'minimal_backoff_time = 60s' # if failed retry after 1 min 
postconf -e 'maximal_backoff_time = 5m' # max time retring 5 min 
 
postconf -e "setgid_group = postdrop"
postconf -e "mail_owner = postfix"
postconf -e "mailq_path = /usr/bin/mailq"
postconf -e "newaliases_path = /usr/bin/newaliases"
postconf -e "sendmail_path = /usr/sbin/sendmail"
postconf -e "manpage_directory = /usr/share/man"
postconf -e "readme_directory = /usr/share/doc/postfix"
postconf -e "html_directory = /usr/share/doc/postfix/html"
postconf -e "alias_maps = hash:/etc/aliases"
postconf -e "alias_database = hash:/etc/aliases"
 
postfix check
systemctl restart postfix@-
systemctl is-active postfix@-
ss -tlnp | grep ':25 '
      • Slef Fix Script [Postfix on Debian] 
        for p in debugger_command sendmail_path newaliases_path mailq_path setgid_group \
 html_directory manpage_directory sample_directory readme_directory; do
      cur=p” 2>/dev/null) if [ -z “(postconf -d -h “def” ] && postconf -e “def” fi done ```
    • DKIM 
       mkdir -p /etc/dkimkeys/fadymoheb.com  # Creat a dir for the keys 
 opendkim-genkey -b 2048 -d fadymoheb.com -s mailvps -D /etc/dkimkeys/fadymoheb.com # Creat the private & Public Keys
 
 chown -R opendkim:opendkim /etc/dkimkeys/fadymoheb.com #  OpenDKIM daemon runs as the opendkim user. It must be able to read the private key
 
 nano /etc/dkimkeys/key.table # <key-name> <domain>:<selector>:<private-key-path>
	 mailvps._domainkey.fadymoheb.com fadymoheb.com:mailvps:/etc/dkimkeys/fadymoheb.com/mailvps.private
 
nano /etc/dkimkeys/signing.table # Which mail gets signed <sender-pattern> <key-name>
	*@fadymoheb.com mailvps._domainkey.fadymoheb.com
	[email protected] mailvps._domainkey.fadymoheb.com # just to be sure 
	
chown root:opendkim /etc/dkimkeys/key.table /etc/dkimkeys/signing.table
chmod 640 /etc/dkimkeys/key.table /etc/dkimkeys/signing.table 
 
nano /etc/opendkim.conf 
	KeyTable     /etc/dkimkeys/key.table
	SigningTable refile:/etc/dkimkeys/signing.table
 
systemctl restart opendkim # restart 
ss -tlnp | grep ':12301 ' # work ? 
 
 
postconf -e 'milter_default_action = accept' # if opendikm unreachaple accept 
postconf -e 'milter_protocol = 6' # milter protocol version 6 
postconf -e 'smtpd_milters = inet:127.0.0.1:12301' # sign via this port [dkim port ]
postconf -e 'non_smtpd_milters = inet:127.0.0.1:12301' # for locally injected not smtpd [sendmail eg.]
 
# grep -o '"[^"]*"' mailvps.txt | tr -d '"' | tr -d '\n'; echo
# Add them as TXT mailvps._domainkey
    • Sending 
      swaks --server 127.0.0.1:25 --from [email protected] --to [email protected] --header "Subject: order summary " --body "order accepted" # Test and Pingo 
 
grep -E "status=" /var/log/mail.log | tail -60 | awk "{print substr(\$1,1,16)}" | uniq -c # See the logs

Tools

Notes

Nodes

1 item under this folder.

Graph View