(untitled)

Hello guys. I got a phishing email today. The link lead to a page (http://thecurlsponge.com/PRoToN/protonmail.html) with the form that POSTS your login and password to http://thecurlsponge.com/PRoToN/fide.php I can't download fide.php because I get redirected instead. thecurlsponge.com has ftp and mysql ports open. I tried to connect anonymously to ftp, but to no avail. I tried root user with no password for their mysql, but failed too. I am an absolute noob in security, and I don't know what to do next. I hope you guys will rekt them!

>>4496 no

Maybe someone could point me as to what to do next? What can I use to try to get into their system? Like, some kind of pure-ftpd or nginx exploit?

>>4496 >I can't download fide.php because I get redirected instead. wget

>>4500 Well, no, server just returns 301.

>>4496 >I can't download fide.php because I get redirected instead. When you access a php page, the webserver runs the php code inside the file and returns the *output* to you. You can't download the php code (unless there is a bug or the webserver is misconfigured). >with the form that POSTS your login and password to http://thecurlsponge.com/PRoToN/fide.php sql injection could be something to try. It might be tricky if the php script is only putting the login and password into a database and then redirecting you though.

Whoever is doing this OP, is hosting their malware on someone else page. I wouldn't recommend hacking them, I would send an email sharing that they are hosting malware.

>>4503 Thanks, I'll try. >>4504 Already done. Why do you think it's someone else's page?

>>4505 It's pretty much phishing campaign 101. The majority of spam that I see come through is from legitimate email addresses (hacked) with links going to legitimate websites (also hacked).

>>4505 It's not uncommon for people to hack into others servers and use it to serve up malware without having to pay hosting fee's and less likely to be tracked to them as well.