email-header-injection

CRLF injection in SMTP headers exploits user-controlled input fields by inserting carriage return and line feed characters to manipulate email headers, enabling BCC injection, CC injection, and body injection to spoof emails or bypass authentication protocols.

To test contact forms for email header injection, inject CRLF sequences into user-controlled fields like subject or reply-to, using a structured testing methodology to identify vulnerabilities in features that construct SMTP messages from user input.

Bypassing SPF, DKIM, and DMARC for email spoofing involves manipulating SMTP header construction to exploit authentication protocol weaknesses, with specific strategies to bypass these email authentication mechanisms for spoofing and phishing amplification.

Yes, this email header injection testing covers vulnerability patterns for PHP mail(), Python smtplib, and Node.js nodemailer, handling SMTP message construction vulnerabilities across these specific programming environments.

Yes, email client rendering attacks can perform CSS-based data exfiltration, remote image tracking, and form action hijacking, exploiting how email clients process and display embedded HTML and CSS content.

User input in password reset flows causes email spoofing when SMTP messages are constructed with unvalidated user-controlled fields, allowing attackers to inject headers to manipulate the recipient or sender for authentication bypass and phishing amplification.