邮件伪造测试-Swaks

1、前言

在kali中自带一个邮件伪造工具Swaks，工具项目主页为 http://jetmore.org/john/code/swaks

2、基本用法：

swaks --to <要测试的邮箱> --from <被伪造的邮箱> --ehlo <网址> --body <邮件内容> --header <邮件标题>

swaks --to xxxx@qq.com --from info@freebuf.com --ehlo freebuf.com --body hello --header "Subject: hello"

3、源码分析

这个工具的原理是将STMP邮件命令封装起来，填写好参数后通过TCP发送。

工具源码：http://jetmore.org/john/code/swaks/files/swaks-20170101.0/swaks

	$n{data} ||= 'Date: %DATE%
To: %TO_ADDRESS%
From: %FROM_ADDRESS%
Subject: test %DATE%
' .
	            "Message-Id: <%MESSAGEID%>
" .
	            "X-Mailer: swaks v%SWAKS_VERSION% jetmore.org/john/code/swaks/".'
' .
	            ($bound ? 'MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="'.$bound.'"
' : '') .
	            '%NEW_HEADERS%' . # newline will be added in replacement if it exists
	            '
' .
	            '%BODY%
';

4、查看IP的办法

阿里云邮箱-查看邮件原文-Received字段就是发送邮件人的IP

QQ邮箱-查看邮件原文

原文中的Received字段就是发件人的IP地址

Received: from 36x.cn (unknown [192.119.131.28])
	by newmx21.qq.com (NewMx) with SMTP id 
	for <xxxxx@qq.com>; Tue, 27 Mar 2018 13:25:07 +0800
X-QQ-SPAM: true
X-QQ-FEAT: s2GiS5gUmyK+eXv9+I/fePc92oQJu9XHtWyzT9PgGcvSpn7dWJrxhFyEnAwTo
	irizSvrfxLHBO0Uqb7XWddQ8Z9xc80zMicgaf6pyCj+5EaD7jNpPkUj3Q43vgXfmxscAQZm
	Oe6ApiG6Du5QFkISrDjb+OQ0ZZZZRHH8i0TOVHHHDCvYHF8RBXG44G53
	MmI3Lhj8CoWPztQ9Oftn5LlkK0/8nxZ1BbYhzKovOY3U27E1qlNUYRLLzC3X3NSs=
X-QQ-MAILINFO: M9mpTqh4QKvqUsonnjk0JTAHsII3lq/kTlJ+R+7KGWo2g8ZOmN0AZJRqQ
	muQ8LXR8jVXXZZZEZTaXbafIHHHHHVNffL3voKA1fvkRCxucXzc=
X-QQ-mid: mx21t1522128307tnl9i9x2f
X-QQ-ORGSender: linwei@36x.cn
Date: Sat, 06 Jan 2018 03:02:36 +0800
To: xxxxx@qq.com
From: linwei@36x.cn
Subject:36x CERT
X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/

welcome

5、发送伪造邮件原理

手法邮件

通过telnet客户端发Email，如下图所示：

swaks工具使用

伪造请求后，可以看到发送的命令。如下图所示：

root@kali:~# swaks --to xxxx@qq.com
=== Trying mx3.qq.com:25...
=== Connected to mx3.qq.com.
<-  220 newmx59.qq.com MX QQ Mail Server
 -> EHLO kali
<-  250-newmx59.qq.com
<-  250-SIZE 73400320
<-  250-STARTTLS
<-  250 OK
 -> MAIL FROM:<root@kali>
<-  250 Ok
 -> RCPT TO:<xxxx@qq.com>
<-  250 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Tue, 05 Jan 2016 23:15:11 -0500
 -> To: xxxx@qq.com
 -> From: root@kali
 -> Subject: test Tue, 05 Jan 2016 23:15:11 -0500
 -> X-Mailer: swaks v20130209.0 jetmore.org/john/code/swaks/
 -> 
 -> This is a test mailing
 -> 
 -> .
<** 550 Mail content denied. http://service.mail.qq.com/cgi-bin/help?subtype=1&&id=20022&&no=1000726
 -> QUIT
<-  221 Bye
=== Connection closed with remote host.

6、安全防护解决方案

1）基于ip 发送频率发送内容发送标题进行策略控制。通过正常邮件频率定义是否为垃圾邮件！
2）配置SPF：SPF 其实就是一条DNS的TXT的记录，其记录值就是 SPF的内容比如：v=spf1 include:spf.mail.qq.com -all"，SPF 需要在域名解析服务器上配置

7、参考

钓鱼邮件初探：黑客是如何进行邮件伪造的？

http://www.freebuf.com/sectool/92397.html

邮件发送和接收原理

https://blog.csdn.net/qq_15646957/article/details/52544099