[jespr]

Hey.

Some time ago I made a program with a feedback function where you could enter a feedback message and it would be sent to my gmail. The problem was I got hacked and I couldn't change the password as it was used for connecting to the SMTP server in my program so to speak.

I'm pretty sure someone could decompile my program and get that email's account name and password as I had never used that email for anything else.

Is there a way or a free obfuscator I could use to dodge hackers that can view my email credentials from the code? I'm thankful for any help!

I'm using VS Express/Visual Basic .NET (2011 i think)

[Dam Son]

No, never store your password in your program. Neither encrypting it or obfuscating it will make it safe.

[jespr]

No, never store your password in your program. Neither encrypting it or obfuscating it will make it safe.

Thank you for your reply. Which way would you recommend getting the password? Via web somehow?

[ۤMD5]

Just create some easy submit system in php and your users won't be able to see any login information

[Dam Son]

Thank you for your reply. Which way would you recommend getting the password? Via web somehow?

Have your email sending program be on a server (so no one else has access to, that way no one can see your password). Then control it with your program.

[jespr]

Just create some easy submit system in php and your users won't be able to see any login information

How do you do that, i mean is there a function in .net for doing such and which is it? I need to get some variables from my program to the mail message.

[Eternal Darkness]

Thank you for your reply. Which way would you recommend getting the password? Via web somehow?

Hosting your own php script and send the data there...
send the data to:

Code

whatever.com/index.php?user=whatever&pass=whatever

On something like: https://hackforums.net/showthread.php?tid=4403274

More secure and less hack-able than any email (still hack-able, with a cracking algorithm)... This way you know you will get the data without sharing a password...

http://stackoverflow.com/questions/14998...put-to-txt
A basic example is given in the answers section, as to how to save the "parameters"(/Post and Get Data, in PHP). Its not the best PHP code, but it should do the trick (change field1 to user, and field2 to pass)...

[Mr.Steven]

How do you do that, i mean is there a function in .net for doing such and which is it? I need to get some variables from my program to the mail message.

You need to create a PHP script which will receive the text from the program and then send it to your Gmail. PHP's function for e-mail is mail. Then you will need to learn how to send POST requests in VB.NET: http://msdn.microsoft.com/en-us/library/....110).aspx

Also, since your program attracted people who want to do "bad stuff", I would recommend you to include spam protection in your PHP script. For example, someone could spam the button in your program and send you many e-mails. You can try preventing that by putting limitations, for example you could make it so there can be only one message sent per x minutes by the same IP address.

[+Haze]

PHP Code


<?php

// subject
$subject="Error / Bug Report";

// Details
$message= addslashes($_GET['msg']);

// Mail of sender this can be anything.
$mail_from="[email protected]";
// From 
$header="from: $name <$mail_from>";

// Enter your email address
$to ='[email protected]';
$send_contact=mail($to,$subject,$message,$header);

// Check, if message sent to your email 
// display  sent message 
if($send_contact){
echo "1";
}
else {
// Uh OHH! Display Error!
echo "0";
}
?>

On your vb program,

Code

Using wc as new webclient
Dim response as string = wc.downloadstring("www.mywebsite.com/mailer.php?msg = " & textbox1.text)

Select case response
Case "1"
msgbox("Msg sent")
Case "0"
Msgbox("msg not sent")
End Select
End Using

---

You need to create a PHP script which will receive the text from the program and then send it to your Gmail. PHP's function for e-mail is mail. Then you will need to learn how to send POST requests in VB.NET: http://msdn.microsoft.com/en-us/library/....110).aspx

Also, since your program attracted people who want to do "bad stuff", I would recommend you to include spam protection in your PHP script. For example, someone could spam the button in your program and send you many e-mails. You can try preventing that by putting limitations, for example you could make it so there can be only one message sent per x minutes by the same IP address.

Using http web requests in this situation is overkill because you could do it in a much simpler way.

[miz™]

Another way is to use different mail acc!
If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)

Like this...

Dim mail As New MailMessage()
Dim SmtpServer As New SmtpClient
SmtpServer.Credentials = New Net.NetworkCredential("[email protected]", "password")
SmtpServer.Port = 587
SmtpServer.Host = "smtp.gmail.com"
SmtpServer.EnableSsl = True
mail.To.Add("[email protected]") <------safe mail
mail.From = New MailAddress("[email protected]")
mail.Subject = "anything"
mail.Body = TextBox1.Text
SmtpServer.Send(mail)

[tweety]

Another way is to use different mail acc!
If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)

Like this...

Dim mail As New MailMessage()
Dim SmtpServer As New SmtpClient
SmtpServer.Credentials = New Net.NetworkCredential("[email protected]", "password")
SmtpServer.Port = 587
SmtpServer.Host = "smtp.gmail.com"
SmtpServer.EnableSsl = True
mail.To.Add("[email protected]") <------safe mail
mail.From = New MailAddress("[email protected]")
mail.Subject = "anything"
mail.Body = TextBox1.Text
SmtpServer.Send(mail)

You missed the point, if they change the password of [email protected] then you're logger doesn't work anymore and requires a new bin.

[miz™]

It was there! just an alternative way untill u find out something safer :D
Iknow u have to recode it if they hack it!

If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)

[+Haze]

It was there! just an alternative way untill u find out something safer :D
Iknow u have to recode it if they hack it!

If they decompile ur program! they only get ur mailsender mail! not ur reciever mail :D
(they can still change pass and stop ur app to work! but ur mail i safe!)

Just use a php mailer. It's so much safer. Not only because its server side but you don't need to enter your email credentials to send an email. So you could spoof an email etc.

[SIM-1676753]

I'd say make an endpoint on your server that handles the user's feedback. You can always delete the server whenever needed. You can also make the user put their a username in order for the server to accept their feedback.

[Corios]

Using http web requests in this situation is overkill because you could do it in a much simpler way.

a webclient is just a wrapper for httpwebrequests :P