0

I've posted this originally on SO, but it may as well be for here.

As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.

Using smtplib in Python, you can easily do the trick by manipulating the From argument.

gmail is not prone to that as they print the via argument which shows the original server.

However, what I cannot find anywhere is how do you retrieve the original (not manipulated) server name, the same as gmail does with their via functionality?

I've tried Python and its imaplib and email libraries, but there I can only access the already manipulated sender.

Any ideas?

Is that solely linked to the configuration of a particular provider (e.g. Google, Outlook, hotmail, etc.), or can something be done regardless of that - not only in Python, but perhaps in other languages, or in Kali?

Here is part of the code I'm currently using in Python (no success):

import imaplib
import email

obj = imaplib.IMAP4('imap', portn)
obj.login('username', 'password')

obj.select('INBOX')

uidl_list = [68720]

resp, data = obj.uid('FETCH', ','.join(map(str, uidl_list)) , '(BODY.PEEK[HEADER.FIELDS (From Subject)] RFC822.SIZE)')

I'm aware that this may be considered a duplicate, however in no other spoofing-related topics have I seen any discussion about how to tackle this.

That's perhaps because it is not possible, and it completely depends on the provider, but any clarification is nevertheless welcome.

  • "gmail is not prone to that as they print the via argument which shows the original server." - I have no idea what "via argument" you are talking about. Please explain this in more detail. Maybe you mean the Received header lines? – Steffen Ullrich Jan 20 at 19:38
  • @SteffenUllrich, I'm talking about this. – arg0naut91 Jan 20 at 19:42
2

First, Google does not know the original sender of the mail either. The original sender can only be known if the mail is signed by the actual sender using PGP or S/MIME and if the recipient can associate the key used for signing with a specific (usually the claimed) sender.

DKIM and SPF at least allow some approximation in that it can be checked if the claimed sender domain in the SMTP envelope is the correct one. But this envelope sender can be different from the claimed sender in the mails From header. With DMARC some kind of alignment of the domains between the envelope sender and the From header can be enforced. But, DKIM, SPF and DMARC need to be actually implemented for the senders domain, i.e. it works only if a domain owner explicitly implements method to protect his domain against getting used for spoofing. And of course it needs to be checked on the recipients side too. And it only checks the senders domain, not the sender inside the domain.

From my understanding of the description Gmail's via gets set if the sender from the SMTP envelope is a different one than the sender claimed in the From header. It will not be shown if both senders are the same, even if they are both spoofed. The envelope sender is usually added to the mail header as Return-Path header. Thus, to get a similar functionality as the via in Gmail just compare Return-Path with From header. But again, this does not necessarily show the real sender of the mail, since both envelope sender and From header can easily be spoofed.

  • Thank you! Now this makes more sense. I've tried to play around with Received and Return-Path, but it seems that in many cases this information may be missing from the e-mail. Is that possible - or is there another header that should be checked? – arg0naut91 Jan 20 at 21:20
  • And not to develop a broad debate on this, as it seems to be a vast topic - would you know of any good resource (book, web, anything) that covers this? – arg0naut91 Jan 20 at 21:20
  • 2
    @arg0naut: This would be a strange environment where these headers are not there. Apart from that there are several posts about spoofing on this site, search for get sender for email or sender spoofing email. – Steffen Ullrich Jan 21 at 4:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.