Email Header Forensics
The guys from @hackerdna have released a warmp challenge about email headers, you can try yourself here…
Email Header Forensics
The guys from @hackerdna have released a warmp challenge about email headers, you can try yourself here: https://hackerdna.com/labs/email-header-forensics
So, in this case we have an eml file
So, we download it and run as usually a file command
❯ file suspicious-email.eml
suspicious-email.eml: SMTP mail, ASCII textWe can use several tools, but the quickest is just open with a text editor
Return-Path: <security@paypal.com>
Delivered-To: john.smith@company.com
Received: from mail-relay.hdna.me (mail-relay.hdna.me [185.234.219.45])
by mx.company.com with ESMTP id a8f3d92c1e456
for <john.smith@company.com>; Thu, 3 Oct 2024 14:23:17 +0000
Received: from unknown (unknown [203.0.113.87])
by mail-relay.hdna.me (Postfix) with ESMTP id 9C4E1A2B8F
for <john.smith@company.com>; Thu, 3 Oct 2024 14:23:15 +0000
Received: from suspicious-server.example.org (suspicious-server.example.org [198.51.100.42])
by mail-gateway.hdna.me with SMTP id x7k2m9p3r1234
for <john.smith@company.com>; Thu, 3 Oct 2024 14:23:10 +0000
From: PayPal Security <security@paypal.com>
To: john.smith@company.com
Subject: Urgent: Verify Your Account - Action Required
Date: Thu, 3 Oct 2024 14:23:08 +0000
Message-ID: <20241003142308.9C4E1A2B8F@suspicious-server.example.org>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_12345_98765.1696342988"
X-Mailer: PhishKit v2.3
X-Originating-IP: 198.51.100.42
X-Priority: 1
X-Spam-Score: 8.5
X-Investigation-ID: INV-2024-10-03-471923
X-Evidence-Hash: YTJmNGU4ZDktZjNhYi00NzExLWI4ZTMtMWE5YzQyZDc2ZTk4
X-Case-Flag: MDk2OTExOWMtNTgyMC00M2M2LThjNjAtYjc3NjNjNTEwYmZl
------=_Part_12345_98765.1696342988
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Dear Valued Customer,
We have detected unusual activity on your PayPal account. For your security,
we need you to verify your account information immediately.
Click here to verify: http://paypal-verify.suspicious-server.example.org/verify
If you don't verify within 24 hours, your account will be suspended.
Thank you,
PayPal Security Team
------=_Part_12345_98765.1696342988
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<html>
<head>
<title>PayPal Account Verification</title>
</head>
<body style="font-family: Arial, sans-serif;">
<div style="max-width: 600px; margin: 0 auto; padding: 20px;">
<img src="http://suspicious-server.example.org/logo.png" alt="PayPal">
<h2 style="color: #003087;">Account Verification Required</h2>
<p>Dear Valued Customer,</p>
<p>We have detected unusual activity on your PayPal account. For your security, we need you to verify your account information immediately.</p>
<div style="text-align: center; margin: 30px 0;">
<a href="http://paypal-verify.suspicious-server.example.org/verify"
style="background-color: #0070ba; color: white; padding: 15px 30px;
text-decoration: none; border-radius: 5px; display: inline-block;">
Verify Your Account Now
</a>
</div>
<p style="color: #cc0000; font-weight: bold;">
If you don't verify within 24 hours, your account will be suspended.
</p>
<p style="font-size: 12px; color: #666;">
Thank you,<br>
PayPal Security Team
</p>
<img src="http://suspicious-server.example.org/track.php?id=user12345"
width="1" height="1" style="display:none">
</div>
</body>
</html>
------=_Part_12345_98765.1696342988--The most relevant are the 2 headers with a base64 encoded string, if we decode it we will be able to grab the flag
메타데이터
- post_id
- 6d7ff570fe43
- slug
- email-header-forensics-6d7ff570fe43
- url
- https://medium.com/@malekith/email-header-forensics-6d7ff570fe43
- canonical_url
- https://medium.com/@malekith/email-header-forensics-6d7ff570fe43
- author_url
- https://medium.com/@malekith
- status
- ok
- fetched_at
- 2026-06-11 16:11:38