thousands emails after ZAP scan

[mra...@gmail.com]

Hi all,

I have a bizarre problem. I have run a scan via ZAP app on one of my clients website and I think that ZAP found a vulnerability because we now receiving over four thousands emails submitted from one of the contact forms on the website. I run the scan on Thursday last week but the emails are still coming in today. I have changed the email that the contact forms are going to but that did nothing as the emails are still coming in to the emails originally set up in the forms.

Not sure how to spot those emails and the client is not happy. 123 reg is hosting the emails and unfortunately there is no manual option to mark those emails as spam. I have submitted a ticket with 123 reg support but no answer yet.

Is there a way to stop receiving these emails? I'm desperate

Thanks for all advice

A

[Simon Bennetts]

Unfortunately these emails will probably be queued up in the email server - once ZAP has finished the scan then its done and the emails will have been sent.
If you cant cancel them at your email server then you probably wont be able to prevent them arriving :(

In a previous job I set up alerts from a live system to go to my work email account, but I didnt put any rate limiting in place.
I came in one morning and there had been a problem in the data centre and I had over 200,000 emails!
I was using Outlook at the time and it just crashed whenever I started it.
Luckily we had a web mail interface, but unfortunately you could only delete emails a page at a time.
So I used a Greasemonkey script with Firefox to page though my inbox, identify emails that matched the alerts and automatically delete them.
It took several hours to run, but it did the job, so you could try something similar?

Cheers,

Simon

[mra...@gmail.com]

Thank you for your reply.

200,000?! Wow! I thought 3000-4000 across 5 days was too much.

Emails finally stopped today! Yes, everything was in the queue as I have tested it by changing the target emails on the form or even disabling the contact forms all together. Couldn't stop the ZAP because it become unresponsive and had to force quit it. 

It was a pain however lesson learned. Next time I'm changing emails before the test.

All the best