Cómo falsificar una dirección de correo electrónico de nivel MIME

1

Como administrador del sistema, necesito enviar correos electrónicos falsificados para garantizar que la protección contra falsificaciones (DMARC, etc.) esté funcionando.

Creo que Fake Mailer de Emkei se puede usar para enviar correos electrónicos falsificados en el nivel SMTP / 5321.MailFrom, pero ¿cómo se pueden enviar correos electrónicos falsificados en el nivel MIME / 5322.Desde el nivel?

2018/10/30 11:45 actualización:

Tras realizar más pruebas, he intentado usar la respuesta de Steffen Ullrich utilizando 3 sistemas SMTP de destinatarios diferentes (The Email Laundry, Office 365 y enlace ) pero en realidad no parece funcionar.

Enviando detalles del nombre de dominio:

  • %código%:
    • política de SPF: sendingsmtp.example
    • política de DMARC: ninguna
  • %código%:
    • política de SPF: v=spf1 ip4:1.2.3.4 -all
    • política de DMARC: ninguna

Salida PuTTY:

220 miniRelay Server v0.9.77d ready
helo Test
500 Syntax Error
helo Test
250 Hello Test
mail from:[email protected]
250 [email protected] Address Okay
rcpt to:[email protected]
250 [email protected] Address Okay
data
354 Start mail input; end with <CRLF>.<CRLF>
from:"MIME Test" <[email protected]>
to:[email protected]
Subject: Test

Test email.
.
250 Ok

Salida de MiniRelay al enviar a The Email Laundry:

11:22:40 Command: MAIL FROM <[email protected]>
11:22:44 Command: RCPT TO <[email protected]>
11:23:10 [1] Looking for MX domain of recipient.example
11:23:10 [1] Connected with array1.theemaillaundry.net
11:23:11 [1] Sending message
11:23:12 [1] Error 5.7.1 <[email protected]>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;[email protected];ip=1.2.3.4;[email protected]
11:23:12 [1] Connected with array1.theemaillaundry.net
11:23:13 [1] Error 5.7.1 <[email protected]>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;[email protected];ip=1.2.3.4;[email protected]
11:23:13 [1] Connected with array1.theemaillaundry.net
11:23:13 [1] Error 5.7.1 <[email protected]>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;[email protected];ip=1.2.3.4;[email protected]
11:23:13 [1] Connected with array2.theemaillaundry.net
11:23:14 [1] Sending message
11:23:14 [1] Error 5.7.1 <[email protected]>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;[email protected];ip=1.2.3.4;[email protected]
11:23:14 [1] Connected with array2.theemaillaundry.net
11:23:15 [1] Error 5.7.1 <[email protected]>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;[email protected];ip=1.2.3.4;[email protected]
11:23:15 [1] Connected with array2.theemaillaundry.net
11:23:16 [1] Error 5.7.1 <[email protected]>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;[email protected];ip=1.2.3.4;[email protected]
11:23:16 [1] ERROR: 3 times retried, returning message

Salida de MiniRelay al enviar a Office 365 y enlace :

11:30:55 Command: MAIL FROM <[email protected]>
11:31:11 Command: RCPT TO <[email protected]>
11:31:26 [3] Looking for MX domain of recipient.example
11:31:26 [3] Connected with recipient.example
11:31:26 [3] Sending message
11:31:26 [3] Message successfully sent

Encabezados de resultados de autenticación de Office 365:

Authentication-Results: spf=fail (sender IP is 1.2.3.4)
 smtp.mailfrom=sendingmime.example; recipient.example; dkim=none (message not
 signed) header.d=none;recipient.example; dmarc=none action=none
 header.from=sendingmime.example;compauth=fail reason=001

enlace resultados del SPF:

[SPF] sendingmime.example does not allow your server 1.2.3.4 to use [email protected]

2018/10/30 12:10 actualización:

Sospeché MiniRelay, así que intenté lo mismo con hMailServer, que funcionó bien.

Salida PuTTY:

220 hMailServer ESMTP
helo Test
503 Bad sequence of commands
helo Test
250 Hello.
AUTH LOGIN
334 VXNlcm5hbWU6
<Base64-encoded username>
334 UGFzc3dvcmQ6
<Base64-encoded password>
235 authenticated.
mail from:[email protected]
250 OK
rcpt to:[email protected]
250 OK
data
354 OK, send.
from:"MIME Test" <[email protected]>
to:[email protected]
Subject: Test

Test email.
.
250 Queued (22.784 seconds)

Encabezados de resultados de autenticación de Office 365:

Authentication-Results: spf=pass (sender IP is 1.2.3.4)
 smtp.mailfrom=sendingsmtp.example; recipient.example; dkim=none (message not signed)
 header.d=none;recipient.example; dmarc=none action=none
 header.from=sendingmime.example;compauth=fail reason=001

enlace resultados del SPF:

[SPF] Your server 1.2.3.4 is authorized to use [email protected]

2018/10/30 12:22 actualización:

El

Servidor SMTP gratuito ( enlace ) parece ser un reemplazo decente, gratuito, local / portátil para MiniRelay que funciona correctamente en este sentido.

    
pregunta mythofechelon 23.03.2017 - 09:50
fuente

1 respuesta

3

Por ejemplo, puede usar telnet y hablar el protocolo SMTP :

> shell-prompt$ telnet some.mail.server 25
< 220 some.mail.server welcome
> helo its.me
< 250 ...
> mail from: [email protected]
< 250 ...
> rcpt to: recipient..
< 250 ...
> data
< 354 ...
> Subject: some fake mail
> From: [email protected]
> To: recipient
> 
> some mail body
> .
< 250 ok

O puedes usar swaks :

swaks --to recipient --from [email protected]

O puede que la biblioteca SMTP para el lenguaje de programación que elija para implementarla: lenguajes como Python, Perl, Ruby, ... todos tienen bibliotecas que le permiten hacer esas cosas fácilmente.

    
respondido por el Steffen Ullrich 23.03.2017 - 10:00
fuente

Lea otras preguntas en las etiquetas