+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] E-mail that's not hackable via reflectors? (/showthread.php?tid=4404032)
Pages: Pages
1
2
E-mail that's not hackable via reflectors? - jespr - Aug 19, 2014
Hey.
Some time ago I made a program with a feedback function where you could enter a feedback message and it would be sent to my gmail. The problem was I got hacked and I couldn't change the password as it was used for connecting to the SMTP server in my program so to speak.
I'm pretty sure someone could decompile my program and get that email's account name and password as I had never used that email for anything else.
Is there a way or a free obfuscator I could use to dodge hackers that can view my email credentials from the code? I'm thankful for any help!
I'm using VS Express/Visual Basic .NET (2011 i think)
* - Dam Son - Aug 19, 2014
No, never store your password in your program. Neither encrypting it or obfuscating it will make it safe.
* - jespr - Aug 19, 2014
(Aug 19, 2014 10:44 AM)vaXine Wrote: No, never store your password in your program. Neither encrypting it or obfuscating it will make it safe.
Thank you for your reply. Which way would you recommend getting the password? Via web somehow?
* - ۤMD5 - Aug 19, 2014
Just create some easy submit system in php and your users won't be able to see any login information
* - Dam Son - Aug 19, 2014
(Aug 19, 2014 10:46 AM)jespr Wrote: Thank you for your reply. Which way would you recommend getting the password? Via web somehow?
Have your email sending program be on a server (so no one else has access to, that way no one can see your password). Then control it with your program.
* - jespr - Aug 19, 2014
(Aug 19, 2014 10:47 AM)☢ MD5 ☢ Wrote: Just create some easy submit system in php and your users won't be able to see any login information
How do you do that, i mean is there a function in .net for doing such and which is it? I need to get some variables from my program to the mail message.
* - Eternal Darkness - Aug 19, 2014
(Aug 19, 2014 10:46 AM)jespr Wrote: Thank you for your reply. Which way would you recommend getting the password? Via web somehow?
Hosting your own php script and send the data there...
send the data to:
Code
whatever.com/index.php?user=whatever&pass=whateverMore secure and less hack-able than any email (still hack-able, with a cracking algorithm)... This way you know you will get the data without sharing a password...
http://stackoverflow.com/questions/14998961/php-write-file-from-input-to-txt
A basic example is given in the answers section, as to how to save the "parameters"(/Post and Get Data, in PHP). Its not the best PHP code, but it should do the trick (change field1 to user, and field2 to pass)...
* - Mr.Steven - Aug 19, 2014
(Aug 19, 2014 10:53 AM)jespr Wrote: How do you do that, i mean is there a function in .net for doing such and which is it? I need to get some variables from my program to the mail message.You need to create a PHP script which will receive the text from the program and then send it to your Gmail. PHP's function for e-mail is mail. Then you will need to learn how to send POST requests in VB.NET: http://msdn.microsoft.com/en-us/library/debx8sh9(v=vs.110).aspx
Also, since your program attracted people who want to do "bad stuff", I would recommend you to include spam protection in your PHP script. For example, someone could spam the button in your program and send you many e-mails. You can try preventing that by putting limitations, for example you could make it so there can be only one message sent per x minutes by the same IP address.
* - +Haze - Aug 19, 2014
PHP Code
<?php
// subject
$subject="Error / Bug Report";
// Details
$message= addslashes($_GET['msg']);
// Mail of sender this can be anything.
$mail_from="[email protected]";
// From
$header="from: $name <$mail_from>";
// Enter your email address
$to ='[email protected]';
$send_contact=mail($to,$subject,$message,$header);
// Check, if message sent to your email
// display sent message
if($send_contact){
echo "1";
}
else {
// Uh OHH! Display Error!
echo "0";
}
?>On your vb program,
Code
Using wc as new webclient
Dim response as string = wc.downloadstring("www.mywebsite.com/mailer.php?msg = " & textbox1.text)
Select case response
Case "1"
msgbox("Msg sent")
Case "0"
Msgbox("msg not sent")
End Select
End Using(Aug 19, 2014 11:04 AM)Mr.Steven Wrote: You need to create a PHP script which will receive the text from the program and then send it to your Gmail. PHP's function for e-mail is mail. Then you will need to learn how to send POST requests in VB.NET: http://msdn.microsoft.com/en-us/library/debx8sh9(v=vs.110).aspx
Also, since your program attracted people who want to do "bad stuff", I would recommend you to include spam protection in your PHP script. For example, someone could spam the button in your program and send you many e-mails. You can try preventing that by putting limitations, for example you could make it so there can be only one message sent per x minutes by the same IP address.
Using http web requests in this situation is overkill because you could do it in a much simpler way.
* - miz™ - Aug 19, 2014
Another way is to use different mail acc!
If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)
Like this...
Dim mail As New MailMessage()
Dim SmtpServer As New SmtpClient
SmtpServer.Credentials = New Net.NetworkCredential("[email protected]", "password")
SmtpServer.Port = 587
SmtpServer.Host = "smtp.gmail.com"
SmtpServer.EnableSsl = True
mail.To.Add("[email protected]") <------safe mail
mail.From = New MailAddress("[email protected]")
mail.Subject = "anything"
mail.Body = TextBox1.Text
SmtpServer.Send(mail)
* - tweety - Aug 19, 2014
(Aug 19, 2014 02:49 PM)miz™ Wrote: Another way is to use different mail acc!
If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)
Like this...
Dim mail As New MailMessage()
Dim SmtpServer As New SmtpClient
SmtpServer.Credentials = New Net.NetworkCredential("[email protected]", "password")
SmtpServer.Port = 587
SmtpServer.Host = "smtp.gmail.com"
SmtpServer.EnableSsl = True
mail.To.Add("[email protected]") <------safe mail
mail.From = New MailAddress("[email protected]")
mail.Subject = "anything"
mail.Body = TextBox1.Text
SmtpServer.Send(mail)
You missed the point, if they change the password of [email protected] then you're logger doesn't work anymore and requires a new bin.
* - miz™ - Aug 19, 2014
It was there! just an alternative way untill u find out something safer :D
Iknow u have to recode it if they hack it!
If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)
* - +Haze - Aug 19, 2014
(Aug 19, 2014 03:07 PM)miz™ Wrote: It was there! just an alternative way untill u find out something safer :D
Iknow u have to recode it if they hack it!
If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)
Just use a php mailer. It's so much safer. Not only because its server side but you don't need to enter your email credentials to send an email. So you could spoof an email etc.
* - SIM-1676753 - Aug 19, 2014
I'd say make an endpoint on your server that handles the user's feedback. You can always delete the server whenever needed. You can also make the user put their a username in order for the server to accept their feedback.
* - Corios - Aug 19, 2014
(Aug 19, 2014 12:41 PM)+Haze Wrote: Using http web requests in this situation is overkill because you could do it in a much simpler way.
a webclient is just a wrapper for httpwebrequests :P