| 1 |
Explore |
[Identify Target Web-Mail Server] The adversary first identifies the web-mail server they wish to exploit. |
|
| 2 |
Experiment |
[Identify Vulnerable Parameters] Once the adversary has identified a web-mail server, they identify any vulnerable parameters by altering their values in requests. The adversary knows that the parameter is vulnerable if the web-mail server returns an error of any sort. Ideally, the adversary is looking for a descriptive error message. |
- Assign a null value to a parameter being used by the web-mail server and observe the response.
- Assign a random value to a parameter being used by the web-mail server and observe the response.
- Add additional values to a parameter being used by the web-mail server and observe the response.
- Add non standard special characters (i.e.: \, ', ", @, #, !, |) to a parameter being used by the web-mail server and observe the response.
- Eliminate a parameter being used by the web-mail server and observe the response.
|
| 3 |
Experiment |
[Determine Level of Injection] After identifying all vulnerable parameters, the adversary determines what level of injection is possible. |
- Evaluate error messages to determine what IMAP/SMTP command is being executed for the vulnerable parameter. Sometimes the actually query will be placed in the error message.
- If there aren't descriptive error messages, the adversary will analyze the affected functionality to deduce the possible commands that could be being used by the mail-server.
|
| 4 |
Exploit |
[Inject IMAP/SMTP Commands] The adversary manipulates the vulnerable parameters to inject an IMAP/SMTP command and execute it on the mail-server. |
- Structure the injection as a header, body, and footer. The header contains the ending of the expected message, the body contains the injection of the new command, and the footer contains the beginning of the expected command.
- Each part of the injection payload needs to be terminated with the CRLF (%0d%0a) sequence.
|