search

gchq / CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
https://gchq.github.io/CyberChef
Apache License 2.0
28.9k stars 3.24k forks source link

Enchancement request : Mail header analyzer #306

Open kevXZY opened 6 years ago

kevXZY commented 6 years ago

Hello

It would be nice to include this function. Very helpful when analyzing spam or suspicious emails.

Thank you

n1474335 commented 6 years ago

Hi @neomh, what would you expect this operation to do? Are you just looking for something that displays the different fields in a table, or would you want it to map out the mail server chain, or something else?

jakewarren commented 6 years ago

throwing my two cents in, even just parsing the headers into "human" readable form would be useful. see https://github.com/lnxg33k/MHA

kevXZY commented 6 years ago

@n1474335 yes in a human readable format, just like in the link @jakewarren posted.

Thanks

shibasecurity commented 6 years ago

Something that does this would be great: http://dogmamix.com/MimeHeadersDecoder/

Example: =?UTF-8?B?RM6XTC3OldGFz4HQs8m1c3M=?= becomes: DΗL-Εхρгɵss

MariasStory commented 6 years ago

Hi, is anyone working on this one?

mattnotmitt commented 6 years ago

I believe @bwhitn has talked about it in the past however I'm not sure whether they have done any work on it.

bwhitn commented 6 years ago

I have done some work on mime Q-encoding. I could probably get this functionality done in a few weeks as I am a bit busy at the moment. What I have so far is at Email.js. My goal was to get Q-encoding, multipart mime to file-list (like zip/tar files), and hop timing done (example Microsoft Header Analyzer). I also was considering a highlighting feature of important email headers (from, to, subject, etc).

TasyDevilsky commented 3 years ago

Any progress from that long time?