email-header-injection
Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.
Security Assessment
About email-header-injection
An email header injection and spoofing playbook for testing any feature that builds SMTP messages from user-controlled fields, including contact forms, email APIs, and password-reset flows. The technical core is CRLF injection: because SMTP headers are separated by carriage-return/line-feed, unsanitized input can smuggle additional headers via %0d%0a, and a blank line lets an attacker take over the message body. It provides an encoding-variant table (URL-encoded, double-encoded, Unicode, raw CRLF, LF-only, and null-byte-prefixed) and concrete scenarios: BCC injection for silent exfiltration, CC and header stacking, full body injection, Reply-To manipulation, and Content-Type injection to render attacker HTML.
It catalogs vulnerable code patterns across PHP mail(), Python smtplib, and Node.js nodemailer, showing which parameters are injectable. Beyond the technical injection, it treats the protocol-level side of email spoofing: SPF bypass (subdomain delegation, include-chain abuse, the 10-DNS-lookup limit causing permerror, +all/?all/~all misconfigurations, and missing records), DKIM bypass (d= versus From mismatch, l= body-length abuse, replay, missing h=from, and key-rotation windows), and DMARC bypass (relaxed alignment, organizational domain, missing record, p=none, and sp=none subdomain policy), each with dig commands to inspect the relevant DNS records.
Use it when assessing whether a mail-sending feature can be abused to add recipients, control message content, or spoof trusted senders for phishing. It highlights display-name spoofing as an approach that works even with perfect SPF/DKIM/DMARC because the display name is not authenticated, and covers mail-client rendering attacks (CSS-based data exfiltration, remote-image tracking pixels, and form-action hijacking) plus contact-form and REST/email-API injection formats. Related skills for general CRLF injection, SSRF to SMTP, and open redirect for phishing amplification are cross-referenced.
FAQ
What makes email header injection possible?
SMTP headers are separated by CRLF, so if user input reaches a header without sanitization, injecting %0d%0a adds arbitrary headers, and a blank line separating headers from body lets an attacker inject the message body.
Which server-side code patterns are flagged as vulnerable?
PHP mail() (the to, subject, and headers parameters), Python smtplib (user-controlled from and subject in an f-string), and Node.js nodemailer (from and subject taken from the request body).
How can spoofing work if SPF, DKIM, and DMARC all pass?
Display-name spoofing. The display name is not authenticated, so a From with a name like [email protected] but an attacker address can appear legitimate, especially on mobile clients that show only the display name.
What DMARC misconfigurations does it target?
Relaxed alignment, organizational-domain alignment, a missing DMARC record, p=none (no enforcement), and sp=none (subdomains spoofable even when the main domain is p=reject), checked with dig TXT _dmarc.target.com.
Besides headers, what other attack surface is covered?
Mail-client rendering attacks: CSS-based data exfiltration, a remote-image tracking pixel, and form-action hijacking, plus contact-form and REST or email-API injection payload formats.
Install email-header-injection
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
yaklang/hack-skills