testing-for-email-header-injection

Email header injection occurs when untrusted user input breaks out of an email template using CRLF characters, allowing attackers to add unauthorized SMTP headers like Cc or Bcc for spam relay or spoofing. Testing requires submitting encoded newline payloads to vulnerable form fields.

SMTP header injection commonly affects contact forms, sharing and invite flows, password reset endpoints, and JSON-based email-sending APIs where user input is directly reflected into outbound email headers without proper newline sanitization.

Automate email header injection testing by providing a target base URL to an agent that systematically generates multiple newline encodings, submits HTTP POST requests to the endpoint, and outputs a JSON report of detected injection indicators.

Burp Suite is not required for detecting email header injection. You can test email APIs by using Python scripts with the requests library to submit encoded newline payloads and generate a JSON report of suspected injection findings.

Effective SMTP header injection testing uses systematic payload generation with multiple CRLF, LF, and CR newline encodings to bypass input filters and successfully break out of email template headers across different web server environments.

Validate email header injection success by inferring impact from HTTP responses and captured email output, then documenting the specific injection point, the newline encoding used, and the expected unauthorized headers added.