email-header-injection

Inject CRLF sequences like %0d%0aBcc:attacker@evil.com into each user-controlled field (subject, from, name) and inspect the received email headers. If the injected header appears, escalate to body injection using a blank line (%0d%0a%0d%0a) to control message content.

Enumerate records with dig TXT target.com and dig TXT _dmarc.target.com. Look for missing records, +all or ~all in SPF, p=none in DMARC, relaxed alignment, or subdomain policies (sp=none). If all are strict, display name spoofing still works since it is not authenticated.

Try double URL-encoding (%250d%250a), LF-only (%0a) since some SMTP servers accept it without CR, Unicode escapes (\u000d\u000a), raw CRLF in the request body, or null byte prefixes (%00%0d%0a). Different frameworks sanitize differently.

PHP mail() is injectable through to, subject, and headers parameters; Python smtplib is vulnerable when user input is concatenated into the raw message string; Node.js nodemailer is injectable via the from and subject options. Any unsanitized user input placed into SMTP headers is a candidate.

Header injection exploits CRLF handling in an application's mail-sending code to add attacker-controlled headers or body content. Spoofing exploits missing or weak SPF/DKIM/DMARC configuration to send email as the target domain from external infrastructure. Both are covered as separate attack surfaces.