diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-08 13:29:30 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-08 13:29:30 +0200 |
| commit | 5caedfb5068683ef793a338fae30f8269f9f865d (patch) | |
| tree | 98aa89ac9740844a3a3fd9caa0c8ac4f40a7235c | |
| parent | e497d06483baea7cb6288cf52ff4c897bf1f00fd (diff) | |
| download | abusectl-5caedfb5068683ef793a338fae30f8269f9f865d.tar.gz abusectl-5caedfb5068683ef793a338fae30f8269f9f865d.zip | |
test: fixtures for the parser, documentation ranges only
Four hand-written messages using example.org, example.invalid and the
RFC 5737 documentation IP ranges. No real phishing sample goes in this
repository: it would carry the recipient identifiers this tool exists to
keep out of reports, and a repository is potentially public.
forged-chain.eml is the one that matters. The attacker prepends two
Received headers naming an innocent third party, so a parser that walks
past the trust boundary reports 198.51.100.7 rather than 203.0.113.99.
Weekdays verified with date(1) rather than written from memory, since an
RFC2822 parser validates the day against the date and a wrong one is
indistinguishable from a malformed header.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R
| -rw-r--r-- | tests/fixtures/forged-chain.eml | 20 | ||||
| -rw-r--r-- | tests/fixtures/redirector.eml | 13 | ||||
| -rw-r--r-- | tests/fixtures/simple.eml | 23 | ||||
| -rw-r--r-- | tests/fixtures/with-attachment.eml | 25 |
4 files changed, 81 insertions, 0 deletions
diff --git a/tests/fixtures/forged-chain.eml b/tests/fixtures/forged-chain.eml new file mode 100644 index 0000000..bfd0cb5 --- /dev/null +++ b/tests/fixtures/forged-chain.eml @@ -0,0 +1,20 @@ +Received: from mx.example.org (mx.example.org [192.0.2.11]) + by mail.example.org (Postfix) with ESMTP id CCC33 + for <you@example.org>; Tue, 8 Sep 2026 11:00:02 +0200 (CEST) +Received: from evil.example.invalid (evil.example.invalid [203.0.113.99]) + by mx.example.org (Postfix) with ESMTP id DDD44 + for <you@example.org>; Tue, 8 Sep 2026 11:00:01 +0200 (CEST) +Received: from innocent.example.invalid (innocent.example.invalid [198.51.100.7]) + by evil.example.invalid (Postfix) with ESMTP id EEE55; Tue, 8 Sep 2026 10:59:00 +0200 (CEST) +Received: from also-forged.example.invalid (also-forged.example.invalid [198.51.100.8]) + by innocent.example.invalid (Postfix) with ESMTP id FFF66; Tue, 8 Sep 2026 10:58:00 +0200 (CEST) +Return-Path: <bounce@evil.example.invalid> +From: "Support" <help@evil.example.invalid> +To: <you@example.org> +Subject: Action required +Message-ID: <bbb222@evil.example.invalid> +Date: Tue, 8 Sep 2026 10:58:00 +0200 +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf-8 + +Visit http://evil.example.invalid/go?u=dGVzdEBleGFtcGxlLm9yZw to continue. diff --git a/tests/fixtures/redirector.eml b/tests/fixtures/redirector.eml new file mode 100644 index 0000000..9bff168 --- /dev/null +++ b/tests/fixtures/redirector.eml @@ -0,0 +1,13 @@ +Received: from sender.example.invalid (sender.example.invalid [203.0.113.42]) + by mail.example.org (Postfix) with ESMTP id HHH88 + for <you@example.org>; Tue, 8 Sep 2026 14:00:00 +0200 (CEST) +Return-Path: <bounce@sender.example.invalid> +From: "Delivery" <notice@sender.example.invalid> +To: <you@example.org> +Subject: Your parcel +Message-ID: <ddd444@sender.example.invalid> +Date: Tue, 8 Sep 2026 14:00:00 +0200 +MIME-Version: 1.0 +Content-Type: text/plain; charset=utf-8 + +Track it: http://t.example.invalid/c?url=http%3A%2F%2Fevil.example.invalid%2Fpay%3Fref%3D99&u=dGVzdEBleGFtcGxlLm9yZw diff --git a/tests/fixtures/simple.eml b/tests/fixtures/simple.eml new file mode 100644 index 0000000..089510b --- /dev/null +++ b/tests/fixtures/simple.eml @@ -0,0 +1,23 @@ +Received: from mx.example.org (mx.example.org [192.0.2.11]) + by mail.example.org (Postfix) with ESMTP id AAA11 + for <you@example.org>; Tue, 8 Sep 2026 10:15:02 +0200 (CEST) +Received: from sender.example.invalid (sender.example.invalid [203.0.113.42]) + by mx.example.org (Postfix) with ESMTP id BBB22 + for <you@example.org>; Tue, 8 Sep 2026 10:15:01 +0200 (CEST) +Authentication-Results: mx.example.org; + spf=fail smtp.mailfrom=sender.example.invalid; + dkim=none; + dmarc=fail header.from=bank.example.invalid +Return-Path: <bounce@sender.example.invalid> +From: "Your Bank" <security@bank.example.invalid> +Reply-To: <collect@drop.example.invalid> +To: <you@example.org> +Subject: Verify your account +Message-ID: <aaa111@sender.example.invalid> +Date: Tue, 8 Sep 2026 10:15:00 +0200 +MIME-Version: 1.0 +Content-Type: text/html; charset=utf-8 + +<html><body> +<p>Please <a href="http://login.bank-verify.example.invalid/verify?id=dGVzdEBleGFtcGxlLm9yZw">confirm</a>.</p> +</body></html> diff --git a/tests/fixtures/with-attachment.eml b/tests/fixtures/with-attachment.eml new file mode 100644 index 0000000..7b1aedc --- /dev/null +++ b/tests/fixtures/with-attachment.eml @@ -0,0 +1,25 @@ +Received: from sender.example.invalid (sender.example.invalid [203.0.113.42]) + by mail.example.org (Postfix) with ESMTP id GGG77 + for <you@example.org>; Tue, 8 Sep 2026 12:00:00 +0200 (CEST) +Return-Path: <bounce@sender.example.invalid> +From: "Accounts" <billing@sender.example.invalid> +To: <you@example.org> +Subject: Invoice attached +Message-ID: <ccc333@sender.example.invalid> +Date: Tue, 8 Sep 2026 12:00:00 +0200 +MIME-Version: 1.0 +Content-Type: multipart/mixed; boundary="BOUND1" + +--BOUND1 +Content-Type: text/plain; charset=utf-8 + +See the attached invoice. + +--BOUND1 +Content-Type: application/pdf; name="invoice.pdf" +Content-Disposition: attachment; filename="invoice.pdf" +Content-Transfer-Encoding: base64 + +SGVsbG8sIHdvcmxkIQ== + +--BOUND1-- |