Understanding how to spoof email addresses is an essential part of running any successful red-team exercise or phishing simulation, particularly when a majority of domains are vulnerable to spoofing in some way, shape, or form!
In this blog, we'll provide a detailed walkthrough on what email authentication protocols are vulnerable to spoofing, how to identify these vulnerabilities at scale, and how to spoof an email address while passing email authentication checks.
Jump To How To Spoof An Email Address
What You'll Learn In This Blog.
- How SPF and DMARC work together to authenticate the origin of an email.
- How SPF can be bypassed by misaligning the email envelope and email content from addresses.
- How to stand-up the necessary infrastructure to perform SPF-bypass attacks.
- How to use telnet to manually send emails with a spoofed email address.
Understanding The Basics
Before we delve straight into vulnerability exploitation, let's cover some fundamentals.
What Is Email Address Spoofing?
Email address spoofing is where someone forges an email address and email display name to appear as though it's from a trusted entity or individual.
Under normal circumstances, email address spoofing shouldn't be possible. If you've heard the acronyms SPF, DKIM, or DMARC, you probably know why. These are all email authentication protocols meant to prevent email spoofing.
It's crucial to acknowledge this because by understanding how these protocols work, we can understand how they can be abused and even bypassed if not configured correctly. To this effect, let's delve into what SPF and DMARC are and how they work together.
What is the Sender Policy Framework (SPF)?
SPF is an email authentication protocol, which is essentially a large list of IP addresses that are published through a public DNS record (known as an SPF record). Each IP address in an SPF record is considered an email sender who is authorized to deliver emails on behalf of a given domain.
Let's say I wanted to deliver an email from an email address at the caniphish.com domain. To do this, I need to send the email from a server with a public IP address listed in the caniphish.com SPF record. If I used an IP address that's not in the SPF record, then the receiver of that email would fail the email authentication check and reject the email as a likely spoofing attempt.
So, now that we know what SPF is, let's answer the following question.
How Is SPF Bypassed?
To answer this, we need to deep-dive into how emails are sent and received.
When an email is received by an email client such as Gmail or Outlook, only a portion of the email is visible to the recipient. The visible portion of an email is called the email content, while the email envelope, which is predominantly used for routing purposes, is hidden from plain view (only visible by viewing the message headers).
It's important to make this distinction between visible and hidden information because this is where there's an inherent vulnerability in the way SPF operates. Cybercriminals can exploit this vulnerability through an attack known as SPF-bypass.
As can be seen in the screenshot above, there are two locations where the from address is specified. The first "mail from:" address located in the email envelope is where SPF authentication checks occur. But as mentioned earlier, everything in the email envelope is hidden from plain view. The second "from:" address located in the email content is what the recipient of the email actually sees in their email client.
Naturally, this raises a question. What if we misalign the "mail from" address in the email envelope with the "from" address in the email content?
This is exactly how an SPF-bypass attack occurs. Cybercriminals will use a domain that they control in the email envelope "mail from" address (that passes SPF checks); they then use the domain of an entity they want to spoof in the email content "from" address.
This is a glaring weakness in the way SPF operates, and it's something that the maintainers of the SPF protocol noticed shortly after its creation, so to prevent spoofing attacks of this nature, a new superseding protocol was created, DMARC.
What is Domain-based Message Authentication, Reporting & Conformance (DMARC)?
DMARC is an email authentication protocol that has a range of functionality, and like SPF, it's a public DNS record. Importantly, it's meant to protect against SPF-bypass attacks.
It does this by enforcing an alignment check against the email from addresses listed in both the email envelope and the email content. If there's a misalignment, the DMARC authentication check will fail, which then causes the email client to reject the email in its entirety.
The problem is that knowledge of how this protocol protects against SPF-bypass attacks is poorly understood on a global scale. A scan conducted in 2022 against 1.7 million Australian domains showed that nearly 60% of all domains were vulnerable to an SPF-bypass attack because their DMARC record either didn't exist or was configured in a non-enforcement mode.
Now that we know how email addresses can be spoofed and what's meant to prevent said spoofing let's delve into how you discover these vulnerabilities and ultimately spoof an email address.
How To Spoof An Email Address
Step 1. Identify A Vulnerable Domain
To spoof an email address, we need to identify a domain that either doesn't have a DMARC record set up or is configured in a way where the DMARC record 'p' qualifier is set in a 'None' non-enforcement configuration.
There are a variety of manual and automated ways to perform these scans, namely running manual searches using the 'dig' command line utility, the email domain scanning tool here at CanIPhish, or even the CanIBeSpoofed open-source project.
Image Reference: Example depicting a dig DMARC query against the wikipedia.org domain.
As an example, we can see that wikipedia[.]org doesn't have an adequately configured DMARC record, so we'll use this example for the remainder of the walkthrough.
Step 2. Obtain An Email Server
This part is easier said than done. Most cloud infrastructure providers prevent the ability to send outbound SMTP emails over TCP port 25 due to the risk of cyber criminals abusing their infrastructure with malicious intent. While saying this, there are various means of legitimately gaining access to infrastructure that supports this, particularly if you work with a large business or institution.
We can proceed with the next step once you have an email server, ideally with a Linux-based operating system that can communicate outbound over TCP port 25.
Step 3. Obtain An Attacker Domain
Earlier, we talked about how SPF-bypass attacks abuse a misalignment between the email envelope and email content from addresses. To take advantage of this misalignment, we must provide a domain we control (i.e., an attacker domain) in the email envelope "mail from" address, which is where SPF authentication is performed, while providing the domain we're spoofing in the email content "from" address.
In preparation for sending an email with a spoofed email address, we need to procure an attacker domain and set up its SPF record so the public IP address attached to the email server setup in Step 2 is listed as an authorized sender.
Accordingly, we need to purchase a domain from a domain registrar such as GoDaddy, Amazon Route 53, or any of the hundreds of registrars out there. This can be any domain you choose (ideally, one that's non-descript and generic).
Once purchased, we need to set the SPF record as follows (replacing <IP-ADDRESS> with the public IP address of your email server):
DNS TXT Record
v=spf1 ip4: <IP-ADDRESS> -all
Step 4. Prepare The Email Spoofing Script
Now that we've identified a vulnerable target domain, we have our email server, our attacker domain, and the corresponding SPF record all set up; we're ready to send out our email with a spoofed email address!
To send this email, we'll be modifying the below script to suit our needs. So copy it out and paste it into your favorite text editor.
telnet <target-mail-server> 25
mail from: <attacker-email-address>
rcpt to: <target-email-address>
from: "<spoofed-display-name>" <%spoofed-email-address%>
subject: Email Demonstration
This is a test
Note: The script above is a slightly modified version from the SPF-Bypass GitHub Project.
Step 4.1. Specify The Target Email Server
To find the email server of our intended target, we'll need to run an MX dig command against the target domain (replacing <target-domain> with the domain of our target recipient). Once run, extract the relevant mail server and update the script by replacing <target-mail-server> on line 1 with the mail server address.
Linux CLI Command
dig <target-domain> MX
Image Reference: Example depicting a dig MX query against the caniphish.com domain.
Step 4.2. Specify The Attacker Domain
Replace <attacker-domain> on line 2 with your attacker domain and <attacker-email-address> on line 3 with an email address at your attacker domain.
Note: The local-part address (i.e. everything before the @ symbol) doesn't have to be real, we just need the domain to be real.
Step 4.3. Specify The Target Email Address
Replace <target-email-address> on lines 4 and 7 with the email address of your intended target.
Step 4.4. Specify The Spoofed Email Address
On line 6, replace <spoofed-display-name> with your preferred display name, and %spoofed-email-address% with the email address that you intend to spoof.
Note: Make sure %spoofed-email-address% still has angle brackets around the email address (e.g. <firstname.lastname@example.org>). This is a formatting requirement for delivering SMTP emails.
Step 4.5. Personalize The Email Body
Replace the subject on line 8 with your preferred subject. Ideally, it should be something for demonstration purposes, and then enter any text you wish below the subject for the email body.
You're now ready to send the email with a spoofed email address!
Step 5. Send An Email With A Spoofed Email Address
Step 5 builds from step 4; please keep your modified script open in your text editor.
Image Reference: Example depicting the delivery of an email with a spoofed email address via telnet.
Step 5.1. Connect To The Target Email Server
Copy line 1 to your clipboard. Paste and then submit the command to your email server's console.
Note: You may need to install telnet on your email server.
Step 5.2. Input The Email Envelope
Copy lines 2-4 to your clipboard. Paste and then submit the sequence of commands to your email server's console.
Note: You will need to press enter twice, as the email server will acknowledge the sender and recipient addresses.
Step 5.3. Transition From The Email Envelope To The Email Content
Copy line 5 to your clipboard. Paste and then submit the command to your email server's console.
Step 5.4 Input The Email Content
Copy lines 6-11 to your clipboard. Paste and then submit the sequence of commands to your email server's console.
Step 5.5 Send The Email
Enter a full-stop "." to notify the target email server that your email is complete and ready for processing. You should receive an immediate notification that the email has been queued for delivery!
Note: If you experience any difficulties with sending the email while following steps 4.6 to 4.10, it could be because your email server doesn't have a trusted IP address or that the target email server needs the commands to be processed in a slightly different format (e.g., surrounding all domains and email addresses with angle brackets).
Step 5.6 Check Your Email Client
After a minute or so, you should receive the email in your inbox. When analyzing the email headers, you should notice the mismatch between the SMTP.MailFrom (i.e., Mail Envelope From) and email content from address.
Image Reference: Example depicting an email with a spoofed email address that's passed SPF authentication in Gmail.
Due to the growing popularity of email spoofing among the cybercrime community, it's becoming increasingly essential to utilize spoofing as part of red-team exercises and phishing simulations.
If you'd like to incorporate this technique into your employee training program without the hassle of obtaining and maintaining your own dedicated attacker infrastructure, create a free account and access the CanIPhish Cloud Platform.