Agent skill · security · yaklang
email-header-injection
Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.
Why this skill is useful
Adds detailed attack scenarios and payload examples for email header injection that are not widely known or documented.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Email Header Injection — Expert Attack Playbook AI LOAD INSTRUCTION: Expert email header injection and authentication bypass. Covers SMTP CRLF injection, SPF/DKIM/DMARC circumvention, display name spoofing, and mail client rendering abuse. Base models miss the nuance between header injection (technical) and email auth bypass (protocol-level) — this skill covers both attack surfaces. 0. RELATED ROUTING crlf-injection — general CRLF injection; email headers are a specific high-value sink ssrf-server-side-request-forgery — when SMTP server is reachable via SSRF (gopher://smtp) open-redirect — redirect in password-reset emails as phishing amplification --- 1. SMTP HEADER INJECTION FUNDAMENTALS SMTP headers are separated by CRLF (\r\n). If user input is placed into email headers without sanitization, injecting %0d%0a (or \r\n) adds arbitrary headers. Injection anatomy Encoding variants to try Encoding Payload --- --- URL-encoded %0d%0a Double URL-encoded %250d%250a Unicode \u000d\u000a Raw CRLF \r\n (in raw request) LF only %0a (some SMTP servers accept LF without CR) Null byte + CRLF %00%0d%0a --- 2. ATTACK SCENARIOS 2.1 BCC Injection — Silent Email Exfiltration 2.2 CC Injection with Header Stacking 2.3 Body Injection — Full Email Content Control A blank line (\r\n\r\n) separates headers from body in SMTP: 2.4 Reply-To Manipulation for Phishing 2.5 Content-Type Injection for HTML Phishing --- 3. COMMON VULNERABLE PATTERNS PHP mail() Python smtplib Node.js nodemailer --- 4. SPF / DKIM / DMARC BYPASS TECHNIQUES 4.1 SPF (Sender Policy Framework) Bypass SPF validates the MAIL FROM envelope sender IP against DNS TXT records. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/email-header-injection