So a friend of Mine asked me to check their Mail server because some emails got lost. Or had a funny signature.

Mails were sent from outlook so ok let's do this.

I go create a dummy account, and send/receive a few emails. All were coming in except one and some had a link appended. The link was randomly generated and was always some kind of referral.

Ok this this let's check the Mail Server.


Let's check the mail header. Nothing.

Face -> wall

Fml I want to cry.

Now I want to search for a pattern and write a script which sends a bunch of mails on my laptop.
Fuck this : no WLAN and no LAN Ports available. Fine let's hotspot the phone and send a few fucking mails.

Guess what? Fucking cockmagic, no funny mails appear!

At that moment I went out and was like chainsmoking 5 cigarettes.


It hit me! A feeling like a unicorn vomiting rainbows all over my face.

I go check their firewall. Shit redirected all email ports from within the network to another server.

Yay nobody got credentials because nobody new it existed. Damn boy.

Hook on to the hostmachine power down the vm, start and hack yourself a root account before shit boots. Luckily I just forgot the credentials to a testvm some time ago so I know that shit. Lesson learned: fucking learn from your mistakes, might be useful sometimes!

Ok fucker what in the world are you doing.

Do some terminal magic and see that it listens on the email ports.

Holy cockriders of the galaxy.

Turns out their former it guy made a script which caught all mails from the server and injected all kind of bullshit and then sent them to real Webserver. And the reason why some mails weren't received was said guy was too dumb to implement Unicode and some mails just broke his script.

That fucker even implented an API to pull all those bullshit refs.

I know your name "Matthias" and I know where you live and what you've done... And to fuck you back for that misery I took your accounts and since you used the same fucking password for everything I took your mail, Facebook and steam account too.

Git gut shithead! You better get a lawyer

  • 10
    Better change his passwords
  • 9
    @UnknownDev that's what I did
  • 5
    Keep us updated
  • 3
    best ending😁
  • 8
    I can only quote what has already been said here, 'Hell hath no fury like a pissed off techie.'
  • 4
    Taking somebody's accounts it not quite "white-hat"...
  • 2

    Comes around goes around :)
  • 1
    Very nice investigation!
  • 4
    @qbasic16 Pure justice comes with punishment ;)
  • 7
    I felt with until the very last paragraph.

    Hijacking someone else's account is not cool, even if you got their credentials and they reuse email and passwords.

    Let them know you got them, yet they must change their password themselves. Otherwise, it might be you that is suddenly in the need for a lawyer.
  • 3
    Taking someones accounts is not cool dude!
  • 0
    Wait from where did you get his password?
  • 4
    @Archetipo from those magic lines in his script

    $email = 'xxxxxxxxx';
    $password = 'xxxxxxx';
  • 1
    @k0pernikus that's what I did. I pretty much just changed his passwords and even sent him a mail can have all back if he apologized.... which he did.
  • 4
    As mentioned before he apologized and the company decided to not press charges because of that.

    But what they did was telling his new employer about the incident. Guess he's now in need of a job instead of a lawyer
Add Comment