Shulou(Shulou.com)06/01 Report--

It is common to see some mail servers actively request requests for malicious domain names. Here, there is a vulnerability of arbitrary forgery of the sender of the smtp protocol. Without the user logging in, we connect to the enterprise's mail server and enter the value of the mail form field, that is, we can make the server actively request the domain name server with this value.

As follows, our value is dada@wannay.com. When the server receives this command, it will actively look up the wannay.com address. If it does not have this record in its mx, it will actively request domain name resolution, resulting in many malicious domain name requests we have seen.

Reflected in traffic flow

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.