Giter Club home page Giter Club logo

forsaken-mail's Introduction

Forsaken-Mail

A self-hosted disposable mail service.

Online Demo

Installation

Setting up your DNS correctly

In order to receive emails, your smtp server address should be made available somewhere. Two records should be added to your DNS records. Let us pretend that we want to receive emails at *@subdomain.domain.com:

  • First an MX record: subdomain.domain.com MX 10 mxsubdomain.domain.com. This means that the mail server for addresses like *@subdomain.domain.com will be mxsubdomain.domain.com.
  • Then an A record: mxsubdomain.domain.com A the.ip.address.of.your.mailin.server. This tells at which ip address the mail server can be found.

You can use an smtp server tester to verify that everything is correct.

Let's Go

general way:

npm install && npm start

if you want to run this inside a docker container

docker build -t denghongcai/forsaken-mail .
docker run --name forsaken-mail -d -p 25:25 -p 3000:3000 denghongcai/forsaken-mail

Open your browser and type in

http://localhost:3000

Enjoy!

forsaken-mail's People

Contributors

denghongcai avatar imfht avatar malaohu avatar yuudi avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

forsaken-mail's Issues

向邮箱地址发送邮件后,docker容器报错退出

基本信息:
CentOS7
Docker version 1.13.1, build 7d71120/1.13.1

报错内容:

[root@warma forsaken-mail]# docker logs cb5673affa92
> [email protected] start
> node ./bin/www
warn: Python is not available. Dkim and spf checking is disabled.
warn: Either spamassassin or spamc are not available. Spam score computation is disabled.
info: Mailin Smtp server listening on port 25
(node:17) Warning: Accessing non-existent property 'padLevels' of module exports inside circular dependency
(Use `node --trace-warnings ...` to show where the warning was created)
/forsaken-mail/node_modules/smtp-server/lib/smtp-stream.js:38
    this.closed = false;
                ^
TypeError: Cannot set property closed of #<Writable> which has only a getter
    at new SMTPStream (/forsaken-mail/node_modules/smtp-server/lib/smtp-stream.js:38:17)
    at new SMTPConnection (/forsaken-mail/node_modules/smtp-server/lib/smtp-connection.js:54:20)
    at SMTPServer.connect (/forsaken-mail/node_modules/smtp-server/lib/smtp-server.js:95:22)
    at SMTPServer.<anonymous> (/forsaken-mail/node_modules/smtp-server/lib/smtp-server.js:84:14)
    at Server.emit (node:events:514:28)
    at TCP.onconnection (node:net:2157:8)
Node.js v20.9.0

存在xss漏洞

使用Gmail发送邮件内容为:

<script>alert(/xss/)</script>
<script>alert(/xss/)</script>
<script>alert(/xss/)</script>

会在forsaken-mail面板上执行JS代码。
eg:
image

会考虑修复吗?

bug:接收不到自动转发过来的邮件

发现个bug,望修复:
bug:接收不到”自动转发“和”来信分类“过来的邮件,测试了163邮箱和21.cn邮箱。
使用场景:自建用来接收转发过来的登录验证码。

怎么增加数据存储

可以增加数据存储吗。我自己用的,这个很简单又好用,但是消息我想存起来,保存一下注册的内容,以防查找,另外后面有邮件进入销毁的邮箱时,还能否收到信息?

一个漏洞: 需要屏蔽一些高权限的邮箱

socket.on('set shortid', function(id) {
onlines.delete(socket.shortid);
socket.shortid = id;
onlines.set(socket.shortid, socket);
socket.emit('shortid', socket.shortid);
})

一个漏洞: 需要屏蔽一些高权限的邮箱, 如下:

  • admin@
  • administrator@
  • webmaster@
  • postmaster@
  • hostmaster@

根据 webtrust 标准, 屏蔽上述邮箱即可.

否则提供临时邮箱的域名, 会存在被冒签 SSL 的高危漏洞.

POC:
image

image

证书地址: https://crt.sh/?id=3842188133

此 SSL 未经过站长授权

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.