đŸ•šī¸
Ghoulsec Vault
Website Toolbase
  • Welcome !
  • đŸ—ƒī¸Exam Prep Notes
    • 📔CEH V13 (Master Edition)
      • Module 02: Footprinting and Reconnaissance
      • Module 03: Scanning Networks
      • Module 04: Enumeration
      • Module 05: Vulnerability Analysis
      • Module 06: System Hacking
      • Module 07: Malware Threats
      • Module 08: Sniffing
      • Module 09 : Social Engineering
      • Module 10: Denial of Service
      • Module 11: Session Hijacking
      • Module 12: Evading IDS, Firewalls , Honeypots
      • Module 13: Hacking web servers
      • Module 14: Hacking Web Applications
      • Module 15:SQL Injection
      • Module 16: Wireless Attacks
      • Module 17: Hacking Mobile Platforms
      • Module 18: IoT & OT Hacking
      • Module 19 : Cloud Computing
      • Module 20 : Cryptography
    • 📘ISC2 -Certified in Cyber Security
      • Chapter -1 Security Principals
      • Chapter -2 Disaster Recovery,Business Continuity & Incident Response
      • Chapter -3 Access Control Concepts
      • Chapter -4 Network Security
      • Chapter -5 Security Operations
    • 📗AZ - 900
      • Basics of Cloud Computing
        • Economic of Scale
        • CapEx & OpEx
        • Consumption based model
        • Cloud Deployment Models
        • Shared Responsibility Model
        • Data centers, Regions & Availability Zones & Geographyies in Azure
        • Resources & Resource Group
        • Azure Access Tools
        • Azure Service Lifecycle
        • Azure SLAs
        • Azure Cloud Adoption Framework
      • Azure Services
        • Azure Computing Services
        • Azure Networking Services
        • Azure Storage Services
        • Azure Database Service
        • Azure Marketplace
        • Big Data & Azure
        • Azure Serverless Computing
        • IoT & Azure
        • Other Azure Services
        • Azure Resource Locks & Resource Tags
        • Azure Security Services
          • Security Groups
          • Routing Tables
          • Azure Firewall
          • Azure DDOS Protection
          • Azure Identity & Access Management (Azure AD)
          • Azure RBAC
          • Azure Security Center
          • Azure Key Vault
      • Azure policies & Blueprints
      • Azure Cost Management
      • Azure Core Tenents
    • 📗SC - 900
      • Zero Trust Model
      • Shared Responsibility Model
      • Defense in Depth
      • Security Controls
      • CIA Triad
      • Encryption / Hashing / Signing
      • Microsoft Security & Compliance Principals
      • Common Identity Attacks
      • Microsoft Identity as Primary Security Perimeter
      • Modern Authentication with Azure AD
      • Azure AD Identity Types
      • Azure External Identities
      • Hybrid Identities
      • Authentication Methods & Password Protection
      • Conditional Access
      • Azure AD Roles & RBAC
      • Governance in Azure AD
      • Azure Identity Protection
      • Azure NSG, DDOS, Firewall
      • Azure Bastion & Keyvault
      • Azure Encryption
      • Azure CSPM
      • Azure Security Center
      • Azure Defender
        • Microsoft O365 Defender
        • Azure Sentinel
      • Microsoft Cloud App Security
      • Microsoft Intune
      • Microsoft Complaince Manager
      • Information Protection
      • Microsoft insider risk capabilities
    • 📔AWS Cloud Practitioner
      • Cloud Deployment
        • AWS Global Infrastructure
      • AWS Cloud Essentials
        • AWS SNS
          • AWS SQS
      • AWS Compute & Container Services
        • AWS EC2
          • Elasticity & Agility
        • AWS Serverless Computing
        • AWS Container Services
        • AWS Beanstalk
        • AWS Load Balancing
      • AWS Storage & Databases
      • AWS Networking
      • AWS Security
        • AWS Organisation
        • AWS Compliance
        • AWS DDOS
        • Additional Security Services
      • AWS Monitoring & Analytics
        • Other Analytics Services
      • AWS Pricing & Support
      • AWS Migration & Innovation
        • Migration Statergies
        • AWS Snow Family
        • AWS Transfer Family
        • Innovation on AWS
      • AWS Well Architecture Framework
      • Other AWS Services
  • 🧑‍đŸ’ģCyber Security Base
    • Ghoul's Den
    • Cheatsheets
    • SSL Handbook
      • Installing OpenSSL
      • Encrypting Web Servers using SSL
      • Compiling .pfx file using openssl
      • De-compiling .pfx file
      • Zimbra Mail Server SSL renew
      • SSL Certificates
    • â˜ī¸Cloud Security
      • Amazon Web Services (AWS)
        • AWS - IAM & Policy Management
        • AWS Organization
        • AWS - Roles (Assume Role)
        • AWS - EC2 (Elastic Computing)
        • AWS - VPC
        • AWS - Bastion Host
        • AWS Application Load Balancer
        • AWS Auto Scaling Group
        • AWS WAF
        • AWS - VPC Peering
        • AWS Transit Gateway
        • AWS NAT Gateway
        • AWS - Route 53
        • AWS Certificates Manager
        • AWS Network Load Balancer (NLB)
    • đŸ•¸ī¸Network Security
      • Firewalls
        • Sophos - Security Suite
          • Sophos Firewalls
      • VPN
        • VPNs
          • Wireguard Tunneling
          • StrongSwan Gateway VPN Server on Ubuntu
      • IP Address and IP Subnetting
      • Basic to Advance Networking Materials
    • 🧑‍đŸ’ģVAPT
      • Sample Report Templete
      • OWASP
        • OWASP Web Application Security & WebGoat
      • Web Application testing checklist
        • Client Side Penetration Testing
          • Clickjacking
          • Websockets
          • CSRF
          • XSS Filters
        • Server Side Penetration Testing
        • Advanced Web Application Pentesting
          • OAuth
          • JWT Injection
          • Server Side Templete Injection
    • â˜„ī¸GRC
      • ISMS AUDIT PLAN
      • CIS Compliance Windows
    • 🔍Forensic
      • Forensic Tools
      • EMAIL Forensics
      • File header forensics
    • Trend Micro
      • Deep Security
        • Installation & Prerequisite
          • Microsoft SQL server 2022
          • Postgres 16 Core
          • Installation
    • Practical Malware Analysis & API Threats
  • đŸ•šī¸Server are fun !
    • Securing Linux
      • Securing SSH
      • Sudoers
      • UFW (Uncomplicated FW)
      • Unattended Upgrades
      • Password Complexiety
      • Auditing Linux
      • Samba - SMB
      • NFS - Network File System
      • FTP
      • AIDE
    • Servers
      • Linux Sever
        • OpenLDAP Server Setup
          • ldap-account-manager
          • Securing OpenLDAP
          • OpenLDAP client setup
          • Checking LDAP setup
        • Users & Groups
        • Password Policy
        • File & File Permissions
        • Automatic Updates
        • Adding GUI to Ubuntu Server
        • DNS Server
        • NTP Server
      • Windows Sever
        • Deep dive into Windows Server
        • Windows server Installation
        • Disable IPv6
        • Disable Server Manager on startup
        • Promoting OS to AD server
        • AD DNS
        • AD DHCP
        • AD Activation
        • AD Users & Groups
        • AD FileServer
        • Adding Users into AD
        • Bulk Importing users into Domain
        • Windows AD Resources
        • Group Policy Editor
          • Creating First Policy
          • Restricting CMD & Powershell
          • Password Policies
          • Audit Policies
          • Log Retention Policy
          • Windows Defender Firewall
          • Patch Management & Window Updates
        • Setting Up local accounts for windows hosts
    • Hacking Systems
      • Linux Systems
        • Battery Charge Threshold (Linux)
        • Metasploitable OS Complete Solved
      • Tricking Windows
        • Bitlocker & Time based policy bypass
    • Monitoring HeartBeats
    • RAID Technology
    • Managing Partitions
      • Parted
      • Fdisk
      • LVM
        • Re-claiming unused disk space
        • Adding physical volume into VG
        • Removing physical volume from VG
      • SWAP Memory
    • Virtualization
      • Proxmox
        • Proxmox VE Installation
        • Default Storage Expansion
        • Proxmox Network Link Aggegration
        • NAT Interface Configuration
        • Importing disk into proxmox
        • Creating an LVM Thin Pool
        • Proxmox IAM
  • đŸ™â€â™‚ī¸Dan the AI Expert
    • Ollama Ollama ...
      • Ollama
        • Ollama models
        • Open Web UI & Ollama Integration
    • Microsoft Presentation using AI
  • đŸ›Ąī¸Security Operations
    • Wazuh - Open Source XDR. Open Source SIEM.
      • Components
      • Deployment Methods
      • Installation
        • Single Node Installation
          • Wazuh Indexer Installation
          • Wazuh Server Installation
          • Wazuh Dashboard Installation
          • Single node deployment with Script
        • Managing multiple Wazuh clusters with Cross-Cluster Search
          • Cluster Configuration
          • Set up Cross-Cluster Search
        • Upgrading Wazuh Central Components
        • Uninstalling Wazuh
      • Custom Decoder & Rules
        • Pfsense Decoders
        • Pfsense Rules
      • Security Operations Center Tools (Wazuh)
    • IRIS-DFIR / Case Management
    • Graylog & ElasticSearch
    • Zabbix NMS
      • Zabbix Installation
      • Zabbix Database Management
        • Zabbix Database backup
        • Zabbix Database restore
        • MySQL Replication (M-M)
        • MySQL Replication (M-W)
      • Zabbix Geomap Setup
      • Adding Hosts into Zabbix
      • Zabbix Hostgroups
      • Auto Registration Hosts Zabbix
      • Zabbix Globalscrips
      • Zabbix HA Cluster
      • Zabbix Proxy
      • Zabbix Notifications
      • Zabbix Maintainance
      • Zabbix User Management & Authentication
      • Zabbix Housekeeping
      • Scheduled Reporting
      • Service Monitoring using Zabbix
  • Git the master!!
    • Configuring git
    • Git Branches
    • Undoing changes
    • Git - Cheat sheet
    • My first git...
Powered by GitBook
On this page
  1. Cyber Security Base
  2. Forensic

EMAIL Forensics

  • SPF : Sender Policy Framework

  • DKIM : Domain keys identified mail

  • DMARC : Domain based Message Authentication Reporting and Conformance

Conformance is how well something, such as a product, service or a system, meets a specified standard

Important Terminologies :

  • MUA : Mail User Agent (Client application)

  • MTA : Mail Transfer Agent (mail-server)

  • MDA : Mail Delivery Agent (The inbox and the receiving side of the email)

  • SMTP Server : The server which is used to send the emails

    • The sender side SMTP checks for the receiving side SMTP

    • SMTP works on port 25

  • POP3(Post Office Protocol) , This automatically download the mails into the receivers hard-disk from the mail server

    • POP3 works on port 110

  • IMAP (Internet message accessing protocol)

    • Used to access the mail

    • IMAP works on port 143 and port 993 (over SSL)

    • IMAP is responsible for the accessibility of the mails across the devices.


Sample Email


Delivered-To: xxxxxxxxxxxxxxxxx@gmail.com
Received: by 2002:a05:6a10:5ce:b0:3b2:908f:fc5b with SMTP id p14csp158167pxt;
        Thu, 19 Jan 2023 00:49:07 -0800 (PST)
X-Google-Smtp-Source: AMrXdXttqIob61vhMjVEzXZT1tST2g+jnjLCo4vt8h37GHWeRjnceLEwYarvAaQT1HDvVfBnZvIt
X-Received: by 2002:a17:90a:3f8b:b0:229:32be:5027 with SMTP id m11-20020a17090a3f8b00b0022932be5027mr10205377pjc.18.1674118147311;
        Thu, 19 Jan 2023 00:49:07 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1674118147; cv=none;
        d=google.com; s=arc-20160816;
        b=EwddRmMU8tNFIDPyPcSef2ydP/WseD+/NSWmyZdeLSgJQ189jLgSTxi3R+or5fAlri
         u7hnS+TofJZeYuHAqjk3LhQdjW6u+eKmwaEEcqf4zqgbKNCwLBt1Z7WXsjbjFiLLuk0G
         XgnNmBX+DY8y2y5A97/stqoiIqkekAoA6oRDtLdbFY6qS5oPS0KkCrJm0zdLGgvBJDKP
         ifisN+6PHdxkANtgFC4DfQBT/aYj5/jV/LsH5/6RcyZmcYU9OwRL5WGks+KWIC821jpJ
         JNkONY6DJG/qaljFTYXwBhuS00UgEtdgGTKatNuXsnhJBQnkP04d8XVguIUmYfvfMpV8
         nD5w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=feedback-id:mime-version:subject:message-id:to:from:date
         :dkim-signature:dkim-signature;
        bh=MIJ7fa4tTIjWGvlyPQrYrnWlYXWYhbVsjhSjiZLgatM=;
        b=LENUz0YwIZR33kzq9VDTk5cyN5ykv/w0eIpjt768nkEfTk1OgvCdnNdlk0EcRX4Yeg
         LWjIwGjBqIFeYG6IL8daSy+yxfWag7OjgBl43LlAawT69gJ+geTrWtzaFTzyEJokHNiM
         ArajMOoAof762BZkt9Xp/oHqsRylvGp16XbKcmiufnFg/liyuXx3teDbCPQ5sExSuZ+M
         FhzU8TSu5RIQjqShoLAUh5O6KJ05aCCgd8GKrelstin577WU1UQy34duM5IH9kHuQVFu
         cp4zsAZNOEnJUH4Jn0x5oCKDCpGvRXBaAJd2QJDwtVYIENNOn9fvWHqn75MglsPS0qj4
         iXJA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@kukufm.com header.s=pyli425i5kfjtqylu3ksnlm54zhw6pbz header.b=4l8mNfeM;
       dkim=pass header.i=@amazonses.com header.s=dvogjbaa3ou3tduyzvyu4rj5tkuzdi4h header.b=EwHYynY8;
       spf=pass (google.com: domain of 01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com designates 76.223.180.103 as permitted sender) smtp.mailfrom=01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com
Return-Path: <01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com>
Received: from c180-103.smtp-out.ap-south-1.amazonses.com (c180-103.smtp-out.ap-south-1.amazonses.com. [76.223.180.103])
        by mx.google.com with ESMTPS id bt14-20020a17090af00e00b00229bf39a1ecsi4502587pjb.76.2023.01.19.00.49.06
        for <vkanjaria99@gmail.com>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Thu, 19 Jan 2023 00:49:07 -0800 (PST)
Received-SPF: pass (google.com: domain of 01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com designates 76.223.180.103 as permitted sender) client-ip=76.223.180.103;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@kukufm.com header.s=pyli425i5kfjtqylu3ksnlm54zhw6pbz header.b=4l8mNfeM;
       dkim=pass header.i=@amazonses.com header.s=dvogjbaa3ou3tduyzvyu4rj5tkuzdi4h header.b=EwHYynY8;
       spf=pass (google.com: domain of 01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com designates 76.223.180.103 as permitted sender) smtp.mailfrom=01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=pyli425i5kfjtqylu3ksnlm54zhw6pbz; d=kukufm.com; t=1674118146; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type; bh=OcX3QpNX3xyJGZZuZ9Bwm2iAIBe0ZDtnxAFS/YJTNuE=; b=4l8mNfeMX18ElNXGIW7qwavDq3zIUPsCzy86hauc+BCySADd3nKtiWztKyITt1sM +hQ82zr+T3i2HBVaezyqtCQXnaPwGtxVfvARB85C3z1X+wHlsyNQ7oqOl8HZ1uNxm4e ej1HSXz3pZd3hba4COwMjcCctGtdOqnoOz4hkca8=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=dvogjbaa3ou3tduyzvyu4rj5tkuzdi4h; d=amazonses.com; t=1674118146; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID; bh=OcX3QpNX3xyJGZZuZ9Bwm2iAIBe0ZDtnxAFS/YJTNuE=; b=EwHYynY8YqWQ/GhFlmnc6Ocgxb37yn40DO/CVkE9v1Abh+bTIrbx3GPNLTIb96Oi 2PiVm0gY4PUaJIE10uGNlp94mKNYQ3qFtRXZgNdU7iYzJiOX8g9yJoa2EUWIIw6O2ly sec8pjNeBhnc/vqJOw+xi+QOaHJIPqyVbuBxxVRk=
Date: Thu, 19 Jan 2023 08:49:06 +0000
From: Kuku FM <premium@kukufm.com>
To: xxxxxxxxxxxxxxxx9@gmail.com
Message-ID: <01090185c937a7fc-b33f74e0-c857-4b46-b23a-b00a246b0a91-000000@ap-south-1.amazonses.com>
Subject: Ready To Meet Taapsee Pannu? Insta Live in 3..2..1
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_516958_1316911195.1674118146035"
X-CleverTap_META: vkanjaria99@gmail.com|1584353664|1674109788|20230119|0|wzrk_default|-52996139|
X-CLEVERTAP_METADATA: { "X-CLEVERTAP_TARGET_ID" : 1674109788, "X-CLEVERTAP_IID" : { "$numberLong" : "52996139" }, "X-CLEVERTAP_IDN" : { "$numberLong" : "52996139" }, "X-CLEVERTAP_PIVOT" : "wzrk_default" }
Feedback-ID: 1.ap-south-1.+gw0gssA1xAY29etckqp1xQFn1bjykPgmPGkMAHXwc4=:AmazonSES
X-SES-Outgoing: 2023.01.19-76.223.180.103

------=_Part_516958_1316911195.1674118146035
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
------=_Part_516958_1316911195.1674118146035--

Actual Process of Email

Step 1: Composing and Sending the Email

  1. User Composes Email: You draft an email on your device, whether it's a computer, smartphone, or tablet.

  2. Clicking "Send": After composing your email, you click the "Send" button in your email client.

Step 2: Routing and Protocols

  1. SMTP (Simple Mail Transfer Protocol): Your email client communicates with your outgoing mail server using SMTP. This protocol helps transfer your email to the server.

Step 3: Outgoing Mail Server

  1. Authentication: The outgoing mail server verifies your credentials to ensure you are authorized to send emails from your account.

  2. Message Submission: The server receives your email and adds it to the queue for delivery.

  3. DNS Lookup: The server performs a Domain Name System (DNS) lookup to find the recipient's mail server based on the recipient's email address domain (e.g., gmail.com).

Step 4: Recipient's Mail Server

  1. MX Record Lookup: The recipient's mail server is determined through DNS by looking up the Mail Exchange (MX) records of the recipient's domain.

Step 5: Delivering the Email

  1. SMTP Communication: Your outgoing mail server connects to the recipient's mail server using SMTP. The two servers communicate to establish a connection.

  2. Recipient Verification: The recipient's mail server verifies that the recipient's email address is valid and exists.

  3. Virus and Spam Scanning: The recipient's mail server may scan the email for viruses, malware, and spam content to ensure the email is safe.

  4. Delivery to Inbox: If the email passes verification and scanning, it is delivered to the recipient's inbox.

Step 6: Recipient Retrieves Email

  1. Email Client Fetches: The recipient's email client (e.g., Outlook, Gmail) connects to the recipient's mail server using protocols like IMAP or POP3 to fetch the newly received email.

Step 7: Viewing the Email

  1. Display in Email Client: The email is displayed in the recipient's email client, and the recipient can read and interact with the content.

This description illustrates the general journey of an email from sender to recipient. Each step involves various technical components like servers, protocols, authentication, and checks to ensure smooth and secure email delivery. You can create diagrams to represent each step for a more visual understanding.


I understand your request now. Here's a simplified step-by-step process with blocks to illustrate what happens to an email after you click "send."

  +----------------+    +-----------------+    +---------------------+
  |                |    |                 |    |                     |
  |   Compose      |    |   Outgoing      |    |  Recipient's        |
  |   Email        |    |   Mail Server   |    |  Mail Server        |
  |                |    |                 |    |                     |
  +----------------+    +-----------------+    +---------------------+
         |                     |                     |
         |                     |                     |
         v                     |                     |
  +----------------+            |                     |
  |                |            |                     |
  |    Click       |            |                     |
  |    "Send"      |            |                     |
  |                |            |                     |
  +----------------+            |                     |
         |                     |                     |
         v                     |                     |
  +----------------+            |                     |
  |                |            |                     |
  |     SMTP       |<-----------+                     |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   Authentication,                                 |
  |   Queueing     |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   DNS Lookup   |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   SMTP to      |                                  |
  |   Recipient's  |                                  |
  |   Mail Server  |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   MX Record    |                                  |
  |   Lookup       |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   Recipient    |                                  |
  |   Verification |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   Virus and    |                                  |
  |   Spam Scanning|                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   Delivery to  |                                  |
  |   Recipient's  |                                  |
  |   Inbox        |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   Recipient's  |                                  |
  |   Email Client|                                  |
  |   Fetches      |                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
  +----------------+                                  |
  |                |                                  |
  |   Display in   |                                  |
  |   Email Client|                                  |
  |                |                                  |
  +----------------+                                  |
         |                                            |
         v                                            |
         |                                            |
         |                                            |
         +--------------------------------------------+
PreviousForensic ToolsNextFile header forensics

Last updated 3 months ago

🧑‍đŸ’ģ
🔍