Instructor: Analyzing email headers. 2 2
In this lesson, we're going to talk about email 3 3
and we're going to dig into looking at some headers. 4 4
Now, first, let's go in and look at 5 5
a legitimate piece of email. 6 6
This is one I've set up in my test environment 7 7
and I'm sending just an email from myself to myself. 8 8
Now here you're going to see that there's a test 9 9
message that went to sam@515support.com. 10 10
When we go in and look at the headers of this though 11 11
we're going to be able to see all of the different pieces 12 12
that are important to us. 13 13
Things like the return path, received 14 14
from, date and content type. 15 15
Now, if we look at the return path this is the address 16 16
that will normally receive the notifications when 17 17
the email message is not deliverable. 18 18
So it'll say, hey, I couldn't get there 19 19
and it sends a message back to the server. 20 20
Normally, this is going to be the same as your sender's email 21 21
but it could be changed by a server. 22 22
This doesn't necessarily mean that it's malicious. 23 23
The next thing we want to look at is received. 24 24
Now under received, you're going to see a list of all the hosts 25 25
that have touched this message as it tried to deliver them. 26 26
You're going to start out in descending order 27 27
and going from the most recent to the least recent. 28 28
This way you could see the entire path of where it's gone. 29 29
Now, in my case, it really only went from one server 30 30
because I'm running all this in a lab environment. 31 31
But in the real world, you'll see this go from 32 32
server to server to server until it finds its way 33 33
from one ISP to the next. 34 34
Then we're going to look at the from. 35 35
Now this is your sender's address. 36 36
Now, in this case, this is a genuine message 37 37
but it is possible to actually spoof this from address. 38 38
And we're going to look at some of that 39 39
as we go through and analyze headers later on. 40 40
The next thing we want to look at is date. 41 41
And again, this is just the date that this was sent. 42 42
And you are going to notice there is a time zone offset here 43 43
based on where the sender sent the message from. 44 44
And finally, we have content type. 45 45
Now, if this is a plain text email it can't have 46 46
any exploits, but if you're using something like HTML 47 47
or Rich Text Formatted messages those can have attachments 48 48
and embeds inside the message that could carry 49 49
malicious links and malicious payloads. 50 50
All right, now this time we're going to go ahead 51 51
and send a phishing email. 52 52
In this case, we're going to impersonate a local user 53 53
because we think that this server has an open relay 54 54
because they haven't secured their email server. 55 55
So I can go in and change my email address. 56 56
So instead of having it go from hostmaster@515.net 57 57
I'm going to go ahead and change that to bobby@515support.com. 58 58
Now, when I do that and I hit okay, this is going to allow me 59 59
to now send messages as Bobby. 60 60
Now I'm going to send a phishing email to sam@515support.com, 61 61
posing as a legitimate employee of 515 Support. 62 62
Now, Sam will think I'm Bobby. 63 63
And when I send this message I'm going to attach 64 64
evilputty.exe from my downloads folder. 65 65
This way, he's going to have a malicious payload. 66 66
So if he opens that email and runs that exe 67 67
I'm going to have control of his system. 68 68
Now, let's go back to my original machine and see 69 69
what happens when Sam tries to get that email. 70 70
Notice here, the email was not delivered. 71 71
That's strange. 72 72
Let's go ahead and take a look at our 73 73
SMTP logs to figure out why. 74 74
All right, here we are in our SMTP logs. 75 75
We're going to go ahead and look at our mail 76 76
server administration and go to settings. 77 77
Then logging, then show logs. 78 78
Here I can see the most recent log file as I open it up. 79 79
Now towards the end of this file you're going to see 80 80
530 SMTP authentication is required. 81 81
Now what does that mean? 82 82
Well, it means this local email server refused the 83 83
connection when I tried to send that email as Bobby. 84 84
Why did it do that? 85 85
Well, because I never authenticated with the server. 86 86
Because this server doesn't have an open relay 87 87
it requires authentication by users and host IP ranges 88 88
whenever they try to connect to it. 89 89
So when I tried to send something as bobby@515support.com, 90 90
it went ahead and stop me because I never logged in 91 91
with Bobby's username and password. 92 92
Now, just to show you what happens here 93 93
I'm going to go ahead and log in as Bobby on his account. 94 94
Now, when I log in as Bobby with his password 95 95
and I open up his email account I can see 96 96
there's a non delivery report. 97 97
This is because that return path was set 98 98
as his email address. 99 99
So when the server wouldn't send my phishing email 100 100
onto the next person Bobby got the kickback message 101 101
going to him and so if he saw this, he could tell 102 102
security folks and they could do some additional research 103 103
to figure out why the delivery didn't happen. 104 104
Or in this case, if it wasn't a message that he sent 105 105
he should report to security that this is suspicious 106 106
activity that someone's trying to create a 107 107
phishing campaign using his email.