SpoofThatMail

SpoofThatMail Bash script to check if a domain or list of domains can be spoofed based in DMARC records File with domains One per line: sh SpoofThatMail.sh -f domains.txt One single domain: sh SpoofThatMail.sh -d domain...

Spoofy

Spoofy WHAT Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records. You may be asking, "Why do we need another tool that can check if a domain can be spoofed?" Well, Spoofy is different and here is why: 1. Custom, manually tested spoof logic No guessing...

Spoof_AnyMail

SpoofAnyMail Most Powerfull Fake Mail Sender Tool SpoofAnyMail Undetectable Tool Commands to run tool in ur terminal Note : Tool is Made of Educational Purposes only. Please try not to harm anyone device it's For Fun Purpose Not For Revenge Join Us All https://bit.ly/3PV3S3r About SpoofAnyMail...

mailMeta

A forensic tool to make analysis of email headers easy to aid in the quick discovery of the attacker. Table of Contents About mailMeta Installation Usage Linux Windows Demo Contributions Inspiration FAQ License About mailMeta What is mailMeta? mailMeta is a python based forensic tool which reads...

espoofer

espoofer espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofi...

Email-Vulnerability-Checker

Email Vulnerability Checker v2.1 Verify whether the domain is vulnerable to spoofing by Email-vulnerablity-checker Features of Version 2.1 Added Support to save output on a file using -o flag Added more checks that will accurately tell you the Vulnerability Status. Updated the code completely wit...

CVE-2026-107774

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather tha...

EUVD-2026-117353

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather tha...

EUVD-2026-117344

The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site...

SimpleEmailSpoofer

SimpleEmailSpoofer A few Python programs designed to help penetration testers with email spoofing. This Project is Retired Due to improvements in email protections and anti-spam techniques, it is no longer effective to attempt to spoof emails simply because they do not have a proper DMARC record ...

CVE-2021-41349

CVE-2021-41349 Exploit! Microsoft Exchange Server Spoofing Vulnerability Exploit! Step To Reproduce! 1. Make A HTTP Request Like This & Capture On Burp 2. Make A CSRF PoC Of That Request & Save The HTML Output Into A File 3. Open The Saved Output In A Browser & Boom Or Use The HTML File Given &...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

CVE-2026-107343: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder: The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability…

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an...

PT-2026-134830

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an...

SpoofcheckSelfTest

SpoofCheck Self Test Web application that lets you test if your domain is vulnerable to email spoofing. NOTE: This application is still in development. Installation: This application is designed to be used as a service. However, if you want to host this yourself, do the following: git clone...

CVE-2024-50964

MX Server misconfiguration CVE-2024-50964 Description A critical vulnerability has been identified in Ferozo Webmail v1.1 , where the MX Mail Exchange server of DonWeb completely disregards configured DMARC Domain-based Message Authentication, Reporting, and Conformance policies. Although domains...

CVE-2023-51764

CVE-2023-51764 Postfix SMTP Smuggling - Expect Script POC send an email that is legitimate, but inside the email there is many others emails different senders, recipients, subjet, etc. The initial email is check for SPF/DKIM/DMARC, the others inside are not ! usage: ./cve-2023-51764.sh mx.fqdn po...

CVE-2023-51764-POC

based on https://github.com/duy-31/CVE-2023-51764 and https://events.ccc.de/congress/2023/hub/en/event/smtpsmugglingspoofinge-mailsworldwide/?trk=publicpostcomment-text its just some poc port to python 3.x...

RedTeamScripts

RedTeamScripts Repository with various Red Team scripts. kill.exe Performing all kind of activities during a red team and you have several process running that you don't want to close manually. kill.exe is for you. copy it in C:\Windows\ and simply call it with the process name you want to kill...

SpamChannel

SpamChannel Live worker hosted at https://spamchannel.haxxx.workers.dev UPDATE Aug 13 2023: Two days after my DEFCON 31 talk, MailChannels silently decided to require aDomain Lockdown Record in order to send emails from Cloudflare Workers meaning this code doesn't work anymore. However, because...