email-header-injection

Name: email-header-injection
Availability: InStock
Author: ok-helloworld

Detect and validate CRLF header injection and spoofing in email-sending flows.

241|28|Updated May 20, 2026

Search Tags:#security testing #smtp #crlf #email header injection #spf dkim dmarc #email spoofing #phishing amplification

Ready to run

npx skills add https://github.com/ok-helloworld/vibe-pentest --skill email-header-injection-ok-helloworld

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: email-header-injection
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/email-header-injection
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill email-header-injection-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you detect and validate email header injection and spoofing weaknesses that allow user-controlled fields to manipulate SMTP headers and email authentication outcomes.

Core Features & Use Cases

CRLF Header Injection Playbooks: Generate and iterate on payloads (e.g., Subject/From/To fields) to confirm whether injected \r\n sequences create extra headers or alter email structure.
Email Auth and Spoofing Checks: Evaluate SPF, DKIM, and DMARC behavior and focus on alignment and policy outcomes relevant to spoof delivery.
Practical Attack Scenarios: Covers BCC/CC stacking, Reply-To manipulation, Content-Type override, and email client rendering abuse for phishing amplification.

Quick Start

Use the email-header-injection skill to test a target’s contact form and password-reset email flows for CRLF injection and spoofing by validating whether injected headers (like Bcc/Reply-To) appear in received messages.

Frequently Asked Questions about email-header-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test contact forms for CRLF injection and email header injection?▼

Email header injection exploits user input fields to manipulate SMTP headers by injecting CRLF sequences. This skill detects spoofing in contact forms and password reset flows by validating whether injected headers alter the email structure and bypass authentication alignment constraints.

What is email header injection and how does CRLF manipulation affect SMTP headers?▼

How do I check SPF, DKIM, and DMARC alignment for email spoofing vulnerabilities?▼

Email header injection allows attackers to manipulate SMTP headers and spoof sender identity by injecting CRLF sequences into user-controlled fields like contact forms. This skill validates whether injected headers alter email structure and bypass SPF, DKIM, and DMARC authentication alignment.

Can I use email header injection testing on password reset and invite flows?▼

Yes, this skill tests password reset and invite flows by injecting CRLF sequences into user-controlled fields mapped to SMTP message construction. It validates whether injected headers alter email structure, routing, or authentication alignment in these critical flows.

What payloads are used for BCC stacking and Reply-To manipulation in email spoofing?▼

Payloads for BCC stacking and Reply-To manipulation inject CRLF sequences into header fields to add hidden recipients or redirect responses. This skill generates and iterates these payloads across header and rendering boundaries to confirm email structure alteration and phishing amplification.

When should I not rely on email header injection for phishing amplification?▼

You should not rely on email header injection when strict SPF, DKIM, and DMARC policies are enforced and properly aligned, as spoof delivery will likely fail. This skill evaluates those authentication constraints to determine whether spoofing impact is actually feasible.