E-mail as a source of information about the network.

• 

Обновлено 13.08.2025 04:03

 

Telegram channel: https://t.me/protectioninformation

Telegram Group: https://t.me/informationprotection1

Website: https://legascom.ru

Email: online@legascom.ru

 

Despite the fact that this material is devoted to social engineering, we are gradually moving on to technical aspects as a result of information collection. Earlier we talked about the corporate portal, where you must have a contact email address. The attacker's task is to send an email to this address and receive a response. Then you need to open the received email in its original form, including the headers.

Received: from mxfront29.mail.yandex.net ([127.0.0.1])

by mxfront29.mail.yandex.net with LMTP id 6Axma6HQ

for<xxxx@yandex.ru>;; Wed, 1 Feb 2012 12:06:10 +0400

Received: from mx1.xxxx.ch (mx1.xxxx.ch [194.209.xx.xx])

by mxfront29.mail.yandex.net (nwsmtp/Yandex) with ESMTP id 696C4lPv-696Wxxxx;

Wed, 1 Feb 2012 12:06:10 +0400

X-Yandex-Front: mxfront29.mail.yandex.net

X-Yandex-TimeMark: 1328083570

X-Yandex-Spam: 1

You can find out the IP address of the sender's mail server from the header provided. Although this address can also be found out in another way, which we will discuss later. Also, the last three lines indicate which

the system was used as an antispam. In this case, it is the anti-spam of Yandex.

By the way, you can get the email properties in the web interface of the free mail service.

Sometimes the properties of mail messages may contain more interesting information, such as the sender's internal IP address. In general, NAT should hide internal addressing, since this information is also interesting to an attacker.