wholeaked

Introduction root@kitploit: , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "When you have eliminated the impossible, /-' \ whatever remains, however improbable, /'-'\ must be the truth" - Sherlock Holmes ' \ wholeaked is a file-sharing tool that allows you to find the responsible person in case...

wholeaked

简介 root@kitploit: , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "当你排除了所有不可能的情况，剩下的， /-' \ 无论多么不可能，都必定是真相" - 夏洛克·福尔摩斯 /'-'\ ' \ wholeaked 是一个文件共享工具，可以在发生泄露时找到责任人。它使用 Go 语言编写。 原理？ wholeaked 获取将要共享的文件和接收者列表。它为每个接收者创建一个唯一的签名，并将其秘密添加到文件中。之后，它可以通过 Sendgrid、AWS SES 或 SMTP...

CVE-2023-33185 Incorrect signature verification in django-ses

Django-SES is a drop-in mail backend for Django. The djangoses library implements a mail backend for Django using AWS Simple Email Service. The library exports the SESEventWebhookView class intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...

HackerOne: Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email service

This was a DoS based on triggering a lot of bounced emails via SES service which could put our email sending up for review with AWS. The vulnerability was due to unrestricted invitations on sandbox programs which allowed an attacker to generate an infinite number of bounced emails. We had applied...

Nextcloud: Missing Rate Limiting protection leading to mass triggering of e-mails

The issue is that there is a speed bump missing in the subscription of e-mail for a user. This would eventually let the attacker spam to any random e-mail resulting in exhaustion of resources on your side and I see that you are using Amazon AWS's SES where you are charged per e-mail. If a dedicat...