CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 952
Comments: 28
block bottom
spacer spacer

Complainterator for Linux
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic       All -> FavForums -> Complainterator [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Fri Mar 28, 2008 9:10 am    Post subject: Complainterator for Linux
Reply with quote

hi,
as a user, I just switched completely to Linux.
Today, apart games, all kind of apps exist and are more powerfull or easily for Linux, so I do not miss Win32.

The major loss, is Complainterator that is only for Win32 platform. My spam grown to 4 times than before.

I want to write a bash script in GPL licence that do in batch mode, what Complainterator do interactively.
This leave the user free to do what he want with him PC, while the script recover the whois data for all the spam and fill the complaint mails. Whois client is embedded in Linux.
As Bash is already ported to MacOS and Win32, that script will be crossplatform.

What is stopping me is the DNS traversal that I cannot reproduce with Linux.
Someone know more about Whois, nslookup, dig and host client options? and specially DNS or named internals?

Back to top
View users profile Send private message
tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2901

Blue Security Premium

PostPosted: Fri Mar 28, 2008 9:39 am    Post subject:
Reply with quote

It is possible to take the Name Server domains from the captured output of either

dig +trace spammed domain ns
host -t ns spammed domain

The traversal ensures that you are not picking up cached values that can be out of date - but that is rare.

Back to top
View users profile Send private message Visit posters website AIM Address
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Mon Apr 21, 2008 10:24 pm    Post subject:
Reply with quote

attached the first alpha version of the bash script.
From a spamvertized URL, it recover registrars emails and DNS registrars emails.
It miss the compose email part, but will be in the next alpha.




xComplaint.tgz
 Description:

Download
 Filename:  xComplaint.tgz
 Filesize:  6.53 KB
 Downloaded:  33 Time(s)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Tue Apr 22, 2008 8:51 am    Post subject:
Reply with quote

as in all GNU GPL General Pubblic License project, the everyone contribute in developing is well accepted.
The only must is to redistribute the source code.

Back to top
View users profile Send private message
kamaraju

Corporal
Corporal


Joined: Mar 07, 2007
Posts: 65
Location: USA

PostPosted: Tue Apr 22, 2008 3:48 pm    Post subject:
Reply with quote

Thanks a ton for making a Linux version.

When I opened the xComplaintContact.txt on a Debian Etch machine running gvim 7.0.235, kernel 2.6.18-6-686, locale en_US.UTF-8, I see seeing lines such as


?????????? ~ zbtec@zbtec.cn
?????????????? ~ sales@sfn.cn
?????????????? ~ service@ce.net.cn
????????????(?????) ~ info@cqhot.cn


Looks like an encoding problem. Can you please use UTF encoding or something better? If it is a problem on my side, please let me know.

raju

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Tue Apr 22, 2008 5:42 pm    Post subject:
Reply with quote

opss...
I cannot substitute the attached file of the prev message.
So I attach a bugfixed x.xx.01 version with contact file in UTF-8




xComplaint.tgz
 Description:

Download
 Filename:  xComplaint.tgz
 Filesize:  7.28 KB
 Downloaded:  36 Time(s)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Tue Apr 22, 2008 9:24 pm    Post subject:
Reply with quote

I test xComplaint on:

- Ubuntu Debian Linux Kernel 2.6.22-14-generic #1 SMP Tue Feb 12 07:42:25 UTC 2008 i686 GNU/Linux with GNU bash, version 3.2.25(1)-release (i486-pc-linux-gnu)
- Cygwin 1.5.25-11 release Mar 9 2008 on WinXP 32bit

Looking for a MacOS tester

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Sun Apr 27, 2008 10:00 pm    Post subject:
Reply with quote

here the alpha Version 0.03.01
Now it send a complaint mail for spamvertized domain only.
Next version send complaint also for NS.

# - parsing parameter for URL
# - prepare the complaint email for domain
# - send complaint for domain mail with a SMTP server/account
# Fixed:
# - use dig when host fail to recover NS
# - skip emailCc when not present for registrar




xComplaint00301.tgz
 Description:

Download
 Filename:  xComplaint00301.tgz
 Filesize:  8.77 KB
 Downloaded:  27 Time(s)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Sun Apr 27, 2008 10:18 pm    Post subject:
Reply with quote

If you want to send automatically the complaint email, sure you have to fill your name and email between "" in the script in the line:

export userMail="Name Surname <email@domain.tld>" # user email

and the smtp server name in the line:

export userSmtp="smtp.domain.tld" # user smtp server

Plase check the mail content and be sure it is logical, before hit a key to send the complaint.

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Mon Apr 28, 2008 7:15 pm    Post subject:
Reply with quote

Here the alpha Version 0.04.01
Now it send a complaint mail also for NS1.




xComplaint00401.tgz
 Description:

Download
 Filename:  xComplaint00401.tgz
 Filesize:  9.16 KB
 Downloaded:  31 Time(s)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Tue Apr 29, 2008 10:58 pm    Post subject:
Reply with quote

Here a bugfix version 0.04.02
# Add: recover IP address for DNS
# Fix; registrar extraction from whois report
# Fix; contact extraction from contact file
# Fix; contact file with Unix NewLine style
# Fix; everytime skip emailCc when not present
# Fix: allineate DNS registrar and contact extraction




xComplaint00402.tgz
 Description:

Download
 Filename:  xComplaint00402.tgz
 Filesize:  9.36 KB
 Downloaded:  29 Time(s)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Wed Apr 30, 2008 9:17 am    Post subject:
Reply with quote

Ver.0.04.02 brake compatibility with Cygwin, as on cygwin the 'host' command used for recovering IP address aren't ported.
There are only the old one 'nslookup'.
In the next version I try to parse the verbose nslookup output to fix this.

I tested on:
Cygwin 1.5.25-11 release Mar 9 2008 on WinXP 32bit
with GNU bash, version 3.2.33(1Cool-release (i686-pc-cygwin)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Sat May 03, 2008 4:56 pm    Post subject:
Reply with quote

Here a bugfix version 0.04.03
# Fix: do not look for IP when host is ""
# Fix: MX record: ns1.poweekeig.com [211.49.115.50 handled] in IP check
# Fix: skip try send complaint when To: contain "***_PASTE_INTO_http"
# Fix: skip try send complaint when not found a registrarTo in contactFile.
# Fix: sometimes 'host' go in timeout and Name Servers was: "out;"




xComplaint00403.tgz
 Description:

Download
 Filename:  xComplaint00403.tgz
 Filesize:  9.96 KB
 Downloaded:  27 Time(s)

Back to top
View users profile Send private message
efa

Sergeant
Sergeant


Joined: Aug 31, 2007
Posts: 139
Location: Italy

PostPosted: Sat May 03, 2008 5:02 pm    Post subject:
Reply with quote

the V0.05.xx is almost completed.
It:
1 - fetch all the unreaded mail from an imap server, in spam folder only
2 - identify all the link
3 - recover registrar and contact emails (V0.04)
4 - recover name server registrar and contact emails (V0.04)
5 - send a complaint email for domain (V0.04)
6 - send a complaint email for name servers (V0.04 partially)

Back to top
View users profile Send private message
kamaraju

Corporal
Corporal


Joined: Mar 07, 2007
Posts: 65
Location: USA

PostPosted: Mon May 05, 2008 2:48 am    Post subject:
Reply with quote

When I tried to use the script as

$./xComplaint http://oiwenierl.com/

[some harmless messages here]

awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1
awk: (FILENAME=- FNR=1) fatal: attempt to access field -1

[more messages here]

Looks like a bug to me. Would appreciate if you can fix this.

thanks
raju

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Complainterator All times are GMT
Goto page 1, 2, 3  Next
Page 1 of 3

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer