domains / families / security / email-header-injection

email-header-injection

separate

Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.

When to use

• testing contact forms
• testing email APIs
• testing password reset flows
• CRLF injection in headers
• SPF/DKIM/DMARC bypass
• phishing amplification
• SMTP CRLF injection
• display name spoofing

Skill page

Source