Email Header Injection

This is a complete playbook for testing email injection vulnerabilities in contact forms, password resets, and any feature that builds SMTP messages from user input. It covers the full attack surface: CRLF injection to add BCC headers or manipulate email bodies, SPF/DKIM/DMARC authentication bypass techniques like subdomain delegation and relaxed alignment, and display name spoofing that works even when all auth checks pass. The source includes actual payloads for PHP mail(), Python smtplib, and Node.js nodemailer, plus less obvious vectors like CSS exfiltration in HTML emails and reply-to hijacking for phishing. Use this when you need to go beyond basic header injection and understand how attackers actually circumvent modern email security controls at both the protocol and client rendering level.