https://dovecot.org/list/dovecot/2009-July/040921.html

 

[Dovecot] AUTH PLAIN error with Thunderbird and Dovecot 1.2

 

dovecot.org

https://book.hacktricks.xyz/network-services-pentesting/pentesting-pop

[Dovecot] AUTH PLAIN error with Thunderbird and Dovecot 1.2

Bernhard Schmidt berni at birkenwald.de
Sun Jul 5 22:54:02 EEST 2009


Hi,

a few days ago I started to get some complaints about authentication
delays from Thunderbird POP3 users. After some debugging it turned out
that the problem was introduced somewhere between 1.2rc3 and 1.2rc7
(1.2.0 is still affected).

A session with Thunderbird 2.0.0.22 against 1.2rc3 looks like this:

<<< +OK Dovecot ready.
>>> CAPA
<<< +OK
<<< CAPA
<<< TOP
<<< UIDL
<<< RESP-CODES
<<< PIPELINING
<<< STLS
<<< USER
<<< SASL PLAIN LOGIN
<<< .
>>> AUTH PLAIN
<<< + 
>>> <base64>
<<< +OK Logged in.

and with 1.2.0 (same client, same config, just replaced the server
binaries)

<<< +OK Dovecot ready.
>>> CAPA
<<< +OK
<<< CAPA
<<< TOP
<<< UIDL
<<< RESP-CODES
<<< PIPELINING
<<< STLS
<<< USER
<<< SASL PLAIN LOGIN
<<< .
>>> AUTH PLAIN
[ 2 seconds delay ]
<<< -ERR Authentication failed.
>>> AUTH LOGIN
[ 5 seconds delay ]
<<< + <base64>
>>> <base64>
<<< + <base64>
>>> <base64>
<<< +OK Logged in.

In the log I see

mail dovecot: auth(default): plain(?,77.2.39.xx): invalid input

Does anyone have an idea? 

# dovecot -n
# 1.2.0: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.28.2 x86_64 Debian squeeze/sid ext4
protocols: imap imaps pop3 pop3s managesieve
listen: *, [::]
ssl_cert_file: /etc/ssl/private/pop3.mucip.net.crt
ssl_key_file: /etc/ssl/private/pop3.mucip.net.key
disable_plaintext_auth: no
login_dir: /var/run/dovecot/login
login_executable(default): /usr/lib/dovecot/dovecot/imap-login
login_executable(imap): /usr/lib/dovecot/dovecot/imap-login
login_executable(pop3): /usr/lib/dovecot/dovecot/pop3-login
login_executable(managesieve):
/usr/lib/dovecot/dovecot/managesieve-login
login_process_per_connection: no
verbose_proctitle: yes
mail_uid: 5000
mail_gid: 5000
mail_location:
maildir:/var/mail/vmail/%1u/%u:INDEX=/var/cache/dovecot/%1u/%u
maildir_stat_dirs: yes
mail_executable(default): /usr/lib/dovecot/dovecot/imap
mail_executable(imap): /usr/lib/dovecot/dovecot/imap
mail_executable(pop3): /usr/lib/dovecot/dovecot/pop3
mail_executable(managesieve): /usr/lib/dovecot/dovecot/managesieve
mail_plugins(default): quota imap_quota fts fts_squat
mail_plugins(imap): quota imap_quota fts fts_squat
mail_plugins(pop3): 
mail_plugins(managesieve): 
mail_plugin_dir(default): /usr/lib/dovecot/imap
mail_plugin_dir(imap): /usr/lib/dovecot/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/pop3
mail_plugin_dir(managesieve): /usr/lib/dovecot/managesieve
imap_idle_notify_interval(default): 900
imap_idle_notify_interval(imap): 900
imap_idle_notify_interval(pop3): 120
imap_idle_notify_interval(managesieve): 120
auth default:
  mechanisms: plain login
  verbose: yes
  passdb:
    driver: ldap
    args: /etc/dovecot/dovecot-ldap.conf
  userdb:
    driver: ldap
    args: /etc/dovecot/dovecot-ldap.conf
  socket:
    type: listen
    client:
      path: /var/spool/postfix-mailout/private/auth
      mode: 432
      user: postfix
      group: postfix
    master:
      path: /var/run/dovecot/auth-master
      mode: 384
      user: vmail
plugin:
  quota: maildir
  quota_rule: *:storage=500M


Thanks,
Bernhard



More information about the dovecot mailing list

 

블로그 이미지

wtdsoul

,

https://github.com/ForgeRock/openam-community-edition/blob/master/openam-federation/OpenFM/src/main/deployable-war/fam-noconsole.list

 

GitHub - ForgeRock/openam-community-edition: Access Management - AuthN, AuthZ, SSO, Fedaration

Access Management - AuthN, AuthZ, SSO, Fedaration. Contribute to ForgeRock/openam-community-edition development by creating an account on GitHub.

github.com

SAML2 이하 경로

블로그 이미지

wtdsoul

,

https://www.secureworld.io/industry-news/critical-vulnerabilities-vehicle-gps

 

Critical Vulnerabilities Discovered in Popular Vehicle GPS Tracker

Six security vulnerabilities have been found in a popular GPS tracker used on vehicles around the world. How to prevent your car from being hacked.

www.secureworld.io

https://nvd.nist.gov/vuln/detail/CVE-2022-37418

 

NVD - CVE-2022-37418

CVE-2022-37418 Detail Description The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive val

nvd.nist.gov

 

'경로 및 정보' 카테고리의 다른 글

AUTH PLAIN error with Thunderbird and Dovecot 1.2  (0) 2023.03.05
SAML2 이하 경로  (0) 2023.03.05
validation / verification 차이  (0) 2023.03.03
iso 21434 참고  (0) 2023.03.03
Embedded Security Testing  (0) 2023.03.03
블로그 이미지

wtdsoul

,

https://www.a-ha.io/questions/49a15af8f21b921bada87a36ee1dfd80

 

 

두가지 용어는 저도 항상 헷갈려서 정리한 적이 있는데 내용 공유드립니다.

Verification (확인)

- 제품을 올바르게 만들고 있는가?

- 명세된 대로 기술되었고 동작하는지 보는 것

- 개발중간산출물에 기술된 내용 자체가 맞는지를 보는 것

- 이전단계에서 만들어진 산출물을 근거로 한 단계의 산출물을 검사하는 것

Validation (검증)

- 올바른 제품을 만들고 있는가?

- 원래 사용자가 원한 대로 개발되었는지를 확인하는 것

- 명세대로 되어 있어도 사용자가 실제로 원한 것이 아닌 사항을 사용자 관점에서 결함으로 보는 활동

만약 개발자가 엉뚱한 명세를 가지고 개발하고 테스트하였다면 Verification 측면에서는 우수한 품질이라고 할 수 있으나 Validation 측면에서는 우수하지 않은 품질이라고 할 수 있다.

 

 

블로그 이미지

wtdsoul

,

https://inspiredhobbyist.org/what-is-automotive-cybersecurity-iso-21434/

 

Automotive Cybersecurity ISO/SAE 21434 standard - Inspired Hobbyist

Automotive cybersecurity standard ISO/SAE 21434 aims to improve the cybersecurity process in the road vehicles engineering. This article guides to understand the standard.

inspiredhobbyist.org

 

 

블로그 이미지

wtdsoul

,

https://www.code-intelligence.com/embedded-security-testingEmbedded Security Testing: Best Practices & Challenges 2023 (code-intelligence.com)

 

Embedded Security Testing: Best Practices & Challenges 2023

Best practices for embedded security testing in 2023. Learn how security testing methods like modern fuzz testing can help to secure embedded software.

www.code-intelligence.com

 

 

블로그 이미지

wtdsoul

,

https://av.tib.eu/media/39853

 

https://av.tib.eu/media/39853

 

av.tib.eu

 

 

 

 

참고

'경로 및 정보' 카테고리의 다른 글

iso 21434 참고  (0) 2023.03.03
Embedded Security Testing  (0) 2023.03.03
ASRG CTF 경로 참고  (0) 2023.03.03
스마트 컨트랙트 코드 분석  (0) 2023.02.28
Ethernaut 블록체인 wargame  (0) 2023.02.28
블로그 이미지

wtdsoul

,

https://cybertalents.com/competitions/asrg-ctf/challenges

 

Challenges » CyberTalents

Cyber Talents is a platform that ranks cyber security talents across the globe according to their skills in different cyber security categories through Capture The Flag Contests in order to be hired by recruiters.

cybertalents.com

 

 

 

블로그 이미지

wtdsoul

,


•1. 이더스캔 접속 : https://etherscan.io/
•2. Transaction 선택
•3. Contract
•4. Code
•5. Read Contract

 

 

 

블로그 이미지

wtdsoul

,

https://orbing.tistory.com/category/%EB%B8%94%EB%A1%9D%EC%B2%B4%EC%9D%B8

https://medium.com/@heuristicwave

 

Heuristic Wave – Medium

Read writing from Heuristic Wave on Medium. Every day, Heuristic Wave and thousands of other voices read, write, and share important stories on Medium.

medium.com

 

 

블록체인 관련 서적
•마스터링 이더리움
•마스터링 비트코인
•Ethernaut : 블록체인 Wargame
•Write-ups
https://orbing.tistory.com/category/%EB%B8%94%EB%A1%9D%EC%B2%B4%EC%9D%B8
https://medium.com/@heuristicwave
•블록체인 해킹 가이드
https://github.com/immunefi-team/Web3-Security-Library
https://medium.com/coinmonks/getting-started-web3-bug-bounties-and-security-2b28c8646f63
https://losslessdefi.medium.com/defi-101-how-to-become-smart-contract-bug-hunter-a5eddab8c7be
•주요 취약점 모음
•https://web3sec.notion.site/web3sec/a69bae6e397c4cdb80b4d120c08bc263?v=3dab7e34c83942abb6a90cd699156ab7
•https://ventral.digital/posts/2022/12/15/ethereum-smart-contract-auditors-2022-rewind
https://hacked.slowmist.io/
https://rekt.news/ko/
•블록체인 오디팅 보고서들
https://immunefi.medium.com/
https://blog.kalos.xyz/
https://github.com/sherlock-protocol/sherlock-reports
https://github.com/HalbornSecurity/PublicReports/tree/master/Solidity%20Smart%20Contract%20Audits
https://github.com/peckshield/publications/tree/master/audit_reports

 

'경로 및 정보' 카테고리의 다른 글

ASRG CTF 경로 참고  (0) 2023.03.03
스마트 컨트랙트 코드 분석  (0) 2023.02.28
전장관련 용어(Braking System 중심으로)  (0) 2023.02.27
Item definition, 아이템 정의  (0) 2023.02.24
OBD2 와 CAN 통신 (BMW) 펌  (0) 2023.02.23
블로그 이미지

wtdsoul

,