From 5caedfb5068683ef793a338fae30f8269f9f865d Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Tue, 8 Sep 2026 13:29:30 +0200 Subject: test: fixtures for the parser, documentation ranges only Four hand-written messages using example.org, example.invalid and the RFC 5737 documentation IP ranges. No real phishing sample goes in this repository: it would carry the recipient identifiers this tool exists to keep out of reports, and a repository is potentially public. forged-chain.eml is the one that matters. The attacker prepends two Received headers naming an innocent third party, so a parser that walks past the trust boundary reports 198.51.100.7 rather than 203.0.113.99. Weekdays verified with date(1) rather than written from memory, since an RFC2822 parser validates the day against the date and a wrong one is indistinguishable from a malformed header. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R --- tests/fixtures/with-attachment.eml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 tests/fixtures/with-attachment.eml (limited to 'tests/fixtures/with-attachment.eml') diff --git a/tests/fixtures/with-attachment.eml b/tests/fixtures/with-attachment.eml new file mode 100644 index 0000000..7b1aedc --- /dev/null +++ b/tests/fixtures/with-attachment.eml @@ -0,0 +1,25 @@ +Received: from sender.example.invalid (sender.example.invalid [203.0.113.42]) + by mail.example.org (Postfix) with ESMTP id GGG77 + for ; Tue, 8 Sep 2026 12:00:00 +0200 (CEST) +Return-Path: +From: "Accounts" +To: +Subject: Invoice attached +Message-ID: +Date: Tue, 8 Sep 2026 12:00:00 +0200 +MIME-Version: 1.0 +Content-Type: multipart/mixed; boundary="BOUND1" + +--BOUND1 +Content-Type: text/plain; charset=utf-8 + +See the attached invoice. + +--BOUND1 +Content-Type: application/pdf; name="invoice.pdf" +Content-Disposition: attachment; filename="invoice.pdf" +Content-Transfer-Encoding: base64 + +SGVsbG8sIHdvcmxkIQ== + +--BOUND1-- -- cgit v1.2.3