DockerMacExec

MALDEV

• Container image with malware and crypto miner for testing purposes
  • Deployment of the vulnerable image
    • CloudFormation - EC2 instance
    • Amazon ECS
    • Amazon EKS
  • Scanner tests
    • Aqua Scanner
    • Trivy Scanner
    • Prisma Cloud Scanner
    • Wiz.io Scanner
    • Anchore - Grype Scanner
    • Snyk Scanner
    • ClamAV
  • Verify image integrity
  • Local tests

Live worker hosted at @

UPDATE ( Aug 13 2023 ): Two days after my DEFCON 31 talk, MailChannels silently decided to require a Domain Lockdown Record in order to send emails from Cloudflare Workers meaning this code doesn't work anymore. However, because they just addressed a "symptom" and not the underlying issue (lack of sender idenitity verification) anyone can still signup on their website (80$) and use their "normal" SMTP relay to spoof all of their customer domains 🤷🏻‍♂️

What is this

As of writing, This allows you to spoof emails from any of the +2 Million domains using MailChannels. It also gives you a slightly higher chance of landing a spoofed emails from any domain that doesn't have an SPF & DMARC due to ARC adoption.

It was released at the Defcon 31 talk SpamChannel: Spoofing Emails From 2 Million+ Domains and Virtually Becoming Satan. Slides for the talk are here

Defcon Talk

See CONTRIBUTING.md.

Dependencies

• CMake
• Boost
• OpenSSL
• libmysqlclient
• EMailSpam

License

GPLv3