Email Spoofing Tutorial

In this tutorial we Unsubscribe a victim from the mailing list he uses to monitor his server up time. This particular list only allows unsubscribing via an email from the victim with the subject line of "Unsubscribe".

There are several ways of accomplishing this such as VNC, webmail or Email Spoofing.

Spoofing is by far the easiest and least risky as it will leave no trace on the machine and requires no real software or vulnerabilities.

To spoof emails all you need is Telnet and some easily obtained information about your ISP providers SMTP server.

The commands used in this tutorial are:

SMTP <server> <port> //Establishes the connection to the SMTP server
HELO <domain> //This command tells the server where you are coming from so it can verify whether the domain you say you are coming from exists
FROM: <email address> \\This is the email address you are spoofing
RCPT TO: <destination>  \\This is the destination email address
DATA \\This tells the server that you are about to start the content for the message
Reply-To: <email address>  \\This creates the reply-to header as the one entered above is not carried into the message
From: <name> \\This is the name in the FROM field shown on the receiving end
Subject: \\The subject line of the message, in our case "Unsubscribe"
\\From here you just type out the message as normal.
. \\The escape character the server gave you when you connected to tell it that you have finished the message content
QUIT \\Gets you out of the server

I hope this tutorial was helpful and showed a real life scenario of how email spoofing is used in real situations.

psyraxis :)