Tool Talk: Spoofy

Watch to explore Spoofy, a domain spoofing tool that checks whether a list of domains (in bulk) can be spoofed based on SPF and DMARC records.

Domain spoofing is a classic offensive security technique, especially for social engineering and red team engagements. Bishop Fox has been a long-time user and creator of open-source email spoofing tools dating back to 2017 when Alex DeFreese, Senior Software Engineer, developed SpoofCheck and shared it with the security community.

Fast forward to 2022 when former Fox, Matt Keeley, created Spoofy adding enhanced functionalities to the foundational techniques of SpoofCheck. We examine Spoofy’s authoritative lookups with a predetermined fallback (Cloudflare DNS), custom spoof logic based on real-world test results, and a SPF lookup counter.

Watch the ninth episode of our Tool Talk series on demand to get an insider’s look at Spoofy. In this livestream, the creator of Spoofy shares:  

  • Why Spoofy was developed
  • How Spoofy enables security professionals
  • A Spoofy demo to find out if your domain is spoofable
Joe sechman

About the author, Joe Sechman

AVP of R&D at Bishop Fox

Joe is a Bishop Fox alumnus. Over his career, Joe has amassed many security certifications, delivered several presentations, and has co-authored multiple industry publications with groups such as ISC2, ISACA, ASIS, HP, and IEEE.

Additionally, Joe is a prolific inventor with nine granted patents in the fields of dynamic and runtime application security testing, attack surface enumeration, and coverage (U.S. Patents 10,699,017, 10,515,219, 10,516,692, 10,515,220, 10,423,793, 9,846,781, 10,650,148, 10,587,641, and 11,057,395). Prior to joining Bishop Fox, Joe held leadership positions with companies such as Cobalt Labs, HP Fortify, Royal Philips, and Sunera LLC (now Focal Point Data Risk). Earlier in his career, Joe served as the lead penetration tester within SPI Labs at SPI Dynamics where he cut his teeth alongside some of the best and brightest application security industry professionals. Joe received his Bachelor of Business Administration degree in Management Information Systems from the Terry College of Business - University of Georgia.
More by Joe
Matt k

About the author, Matt Keeley

Security Researcher

Matt Keeley is former Senior Security Consultant at Bishop Fox specializing in application penetration testing, product security reviews, and source code analysis. He holds a Bachelor of Science in Computer Science (Cybersecurity) from Arizona State University Master of Science Computer Science from Georgia Institute of Technology. During his sophomore year at ASU, Matt co-founded the DevilSec cybersecurity club, where he presents weekly red/blue team topics to students and arranges for top speakers, CEO’s, and guests of honor to present on industry related subjects. Matt is an avid security researcher and is considered an internal subject matter expert for product security reviews. He was also recently quoted in IT Business Edge and interviewed on the InfoSec Prep podcast. Matt currently holds his OSCP, OSWE, OSCE, OSWP and CRTO certifications.

More by Matt

Extend Your Knowledge

Check out these related resources.

Bishop Fox Tool Talk episode 7 CloudFox to find exploitable attack paths in cloud infrastructure presented by three security consultants
Webcast

Tool Talk: CloudFox

Watch as we explore Bishop Fox’s very own CloudFox, a command line tool that helps offensive security practitioners navigate unfamiliar cloud environments and find exploitable attack paths in cloud infrastructure. Tune in to our livestream for a demo of CloudFox!

Learn More
Bishop Fox Tool Talk Episode 8 asminject.py
Webcast

Tool Talk: asminject.py

Watch as we explore Bishop Fox’s very own asminject.py, a code injection tool that tampers with trusted Linux processes to capture sensitive data and change program behavior.

Learn More
2022 Edition Favorite Tools of the Year. Purple tool and silver tool stacked tool drawers with wheels on bottom and Bishop Fox logo on side. Purple background.
Industry

Dec 27, 2022

Our Favorite Tools of the Year: 2022 Edition

By Britt Kemp

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.