Testing for Email Header Injection

When to Use

• When testing contact forms, feedback forms, or "email a friend" functionality
• During assessment of password reset email functionality
• When testing newsletter subscription or notification email systems
• During penetration testing of applications that send emails based on user input
• When auditing email-related API endpoints for header injection

Prerequisites

• Burp Suite for intercepting and modifying HTTP requests
• Understanding of SMTP protocol and email header structure
• Knowledge of CRLF injection techniques (\r\n sequences)
• Test email accounts for receiving injected emails
• Access to application features that trigger email sending
• SMTP server logs access for monitoring injection attempts

Workflow