search

The-Login / SMTP-Smuggling-Tools

Tools for finding SMTP smuggling vulnerabilities.
MIT License
105 stars 23 forks source link

Use a different Message-ID for the smuggled message #3

Closed ghen2 closed 9 months ago

ghen2 commented 9 months ago

to avoid tripping duplicate message-id checks.

ghen2 commented 9 months ago

Hi

I had some tests failing in a setup where I expected it to succeed (two deliveries seen on MX level, but only one message in inbox).

Turns out the wrapper message and the smuggled message have identical Message-ID headers, and the LMTP backend drops the smuggled message due to duplicate message-id.

This patch makes the test use a different message-id for the smuggled message, and makes it pass through to the backend.

The-Login commented 9 months ago

Thanks, good catch!