# Applying Security Engineering to Make Phishing Harder - A Case Study

Multiple phishing-hardening flaws in a CPaaS platform: trailing-dot extension bypass, unanchored domain regex, encrypted-archive AV bypass, hidden HTML param, and RTLO/Punycode link spoofing.

- Payout: Research
- Severity: medium
- Program: Doyensec client CPaaS
- Write-up by: Doyensec
- Disclosed: 2024-09-18
- Write-up quality: 6/10
- Original: https://blog.doyensec.com/2024/09/19/phishing-case-study.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2024-09-19-phishing-case-study-html
- Tags: area:web domain:web impact:integrity kind:research platform:research sev:medium tech:email technique:parser-differential vuln:file-upload vuln:misconfiguration vuln:open-redirect

**Target:** File upload, link allowlist, messaging API, link rendering
**Root cause:** Extension allowlist accepted empty extension after trailing dot; domain allowlist regex unanchored; AV skipped encrypted zips; public API accepted hidden HTML param; links rendered without Punycode/RTLO filtering.
**Steps:**
1. Upload `malware.exe.` — server sees empty extension, accepts; Firefox/Chromium strip trailing dot, saving as `.exe`.
2. Register `acme-attachments-1.com.doyensec.com` to bypass unanchored regex `/acme-attachments-1.com/` in link allowlist.
3. Create encrypted archive `zip -e test_encrypted.zip eicar.com` to evade AV scanning.
4. Send message via public API with hidden HTML-allowing parameter to spoof link-as-button UI.
5. Craft RTLO link `[U+202E]https://gepj.net/selif#/moc.rugmi` and filename `test.[U+202E]fdp.zip` to reverse displayed order.
**How found:** Focused phishing/social-engineering review: testing upload edge cases, reading domain allowlist regexes, and examining how links/filenames are rendered to users.
**Exploitation:** Attacker uploads executable via trailing-dot bypass, hosts phishing page on lookalike subdomain passing the regex allowlist, and delivers links/filenames whose rendered order or Unicode appearance misleads victims into credential theft.
**Insight:** When auditing upload allowlists, test trailing dots/spaces and empty-extension edge cases; when reviewing domain allowlists, check regex anchoring and unescaped dots — both are cheap bypasses with high phishing value.

## Proof of concept (copied exactly from the original report)

**Encrypted zip bypasses antivirus scan**

```
$ zip -e test_encrypted.zip eicar.com.
```

**Trailing dot bypasses extension restriction**

```
crafting an upload request with a prohibited extension, such as .exe.. This resulted in the system accepting the file, since it ostensibly met the criteria for allowed uploads - which included an empty extension. However, Firefox and Chromium-based browsers remove the dangling dot (interestingly, Safari retains it). As a result, the file was saved with an original .exe extension on the victim’s filesystem
```

**Regex allowlist bypass via crafted subdomain**

```
An attacker could create a subdomain similar to acme-attachments-1.com.doyensec.com, which would be accepted despite this security mechanism
```