A method for automatically generating, sending, and detecting security test emails

Abstract

The present invention provides a method for automatically generating, sending, and detecting security test emails, and belongs to the technical field of security validity verification. The method for automatically generating security test emails provided by the present invention reduces manual operations: the automated system can quickly generate emails based on templates, avoiding manual modification of EML files and improving email construction efficiency. In addition, it supports batch email generation: a large number of emails can be constructed at one time, which is suitable for large-scale email testing or marketing activities. Furthermore, the flexible email construction method supports both EML file replacement and standardized construction modes, which can meet different email security testing business needs. When the anonymous email sending rate is low, the method of the present invention reduces the probability of the email being intercepted or classified as spam by querying the MX record of the receiving server and selecting a locally adapted SMTP server as the sending server, thereby improving the successful delivery rate of the email.

Description

Technical Field

[0001] The present invention relates to the technical field of security effectiveness verification, and in particular to an automatic generation method, a sending method and a detection method of a security test email. Background Art

[0002] Email gateways, as core communication security devices for enterprises and organizations, are responsible for email sending and receiving management, content filtering, spam prevention, virus scanning, and policy control. With the increase in network security threats and the continuous evolution of email transmission protocols, the security, stability, and reliability of email gateways have become crucial components of enterprise IT infrastructure. However, current methods for verifying the effectiveness of email gateways primarily rely on passive monitoring or manual testing, lacking systematic automated verification mechanisms. This makes it difficult to meet enterprises' demands for efficient, continuous, and accurate verification.

[0003] Currently, email transmission primarily relies on protocols such as SMTP (Simple Mail Transfer Protocol), IMAP (Internet Message Access Protocol), and POP3 (Post Office Protocol, version 3). To improve email security, common email security technologies include:

[0004] TLS (Transport Layer Security) encryption: used to protect SMTP, IMAP, and POP3 communications;

[0005] SPF (Sender Policy Framework), DKIM (Domain Keys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance): used to verify the identity of email senders and prevent forged email attacks.

[0006] Anti-spam technology: Block spam based on blacklists, content analysis, Bayesian filtering and other methods.

[0007] Currently, the validity verification methods of mail gateways mainly include:

[0008] Manual testing: Operations and maintenance personnel manually construct test emails, send them to designated mailboxes, and manually check whether the emails are delivered normally. This method is inefficient, difficult to promote on a large scale, and cannot be continuously monitored.

[0009] Log analysis: This tool analyzes the email gateway's logs to determine whether an email was successfully delivered. However, log analysis only reflects the email's processing status and cannot verify the email's final status in the destination mailbox.

[0010] Regular script testing: Some companies use customized scripts to simulate email sending and receiving. However, due to the high maintenance cost and poor scalability of scripts, they are difficult to adapt to the configuration and rule changes of different email gateways.

[0011] Currently, there are some email automation testing tools on the market, such as:

[0012] MailTester: Used to check whether the mail server configuration is correct, but it only supports a single test and cannot perform long-term monitoring.

[0013] Gmail API / Outlook API: Allows developers to automate email sending and receiving through APIs, but relies on specific email service providers and is difficult to fully verify with internal corporate email gateways.

[0014] Selenium + Webmail: This method can simulate users logging into a web mailbox to test email sending and receiving. However, this method has poor compatibility with different webmail systems and is easily affected by UI changes.

[0015] Although the above method can verify the functionality of the mail gateway to a certain extent, there are the following problems in actual application:

[0016] 1. Low degree of automation: Traditional testing methods rely on manual operations or customized scripts, which are difficult to meet the needs of normalization and automation.

[0017] 2. Inability to verify the entire process: Existing methods mostly focus on the email transmission process and lack the ability to automatically verify the status of the email in the target mailbox.

[0018] 3. Lack of customized testing strategies: Enterprise users cannot flexibly define different testing scenarios, such as specific attachments, different email protocols, special character encodings, etc. Summary of the Invention

[0019] The purpose of the present invention is to overcome the above-mentioned technical deficiencies and provide a method for automatically generating, sending and detecting security test emails, so as to solve the problem in the related art that the automation level of network penetration testing behavior by means of emails is not high.

[0020] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0021] According to a first aspect of the present invention, a method for automatically generating a security test email is provided, comprising:

[0022] Generate non-standardized custom emails by parsing and modifying existing EML files;

[0023] Generate a standardized EML file by initializing the email builder, constructing the email header, generating the email body, and adding attachments.

[0024] Preferably, generating a non-standardized custom email by parsing and modifying an existing EML file includes:

[0025] Read an existing EML file and parse it using Python's email module to obtain email metadata: email headers, body, and / or attachments.

[0026] Parsing the email header and modifying the email header content to make it conform to preset standards;

[0027] Parse the text and modify the content according to test requirements;

[0028] If the parsed email metadata contains attachments, keep the attachments unchanged or replace some of them based on the test requirements;

[0029] Reconstruct the EML file based on the modified email header, body, and / or attachments;

[0030] According to the test requirements, if DKIM signature is enabled, the DKIM signature is inserted into the header field of the reconstructed EML file to generate the final customized email.

[0031] Preferably, parsing the email header and modifying the email header content to make it conform to a preset standard includes:

[0032] Parsing the email header and extracting at least the following fields: sender address, recipient address, sending time, and email subject;

[0033] When the email subject contains non-ASCII characters, it is converted to Base64 encoding to ensure that the email header complies with the SMTP protocol specification and avoid email rejection or parsing errors caused by character encoding issues.

[0034] Check whether the unique identifier Message-ID in the email header is repeated. If so, modify the unique identifier Message-ID to ensure its uniqueness to avoid being identified as a duplicate email by the server and rejected or discarded.

[0035] Preferably, the parsing of the text and the modification of the text content according to the test requirements include one or more of the following methods:

[0036] According to the test requirements, replace the plain text content marked with text modification in the text;

[0037] According to the test requirements, replace the embedded image or QR code in the text, and update the reference relationship between the content identifier CID and the replaced embedded image or QR code.

[0038] Preferably, generating a standardized EML file by initializing an email builder, constructing an email header, generating an email body, and adding attachments includes:

[0039] Initialize the mail constructor and create an empty mail structure;

[0040] Set the email header information: fill in the sender, recipient, and subject;

[0041] By performing hash calculation on the Message-ID, a fixed-length unique identifier id_hash is generated to uniquely identify the email;

[0042] Insert DKIM signature in the header field of the email;

[0043] Generate email body in plain text format and / or HTML format according to test requirements;

[0044] Add attachments according to test requirements and selectively encrypt them;

[0045] The constructed email header, email body and attachments are combined according to the MIME protocol, and the byte length of the email body and / or the byte length of the attachments are calculated. The calculated byte lengths are inserted into the corresponding fields of the email header for verification by the email recipient.

[0046] According to a second aspect of the present invention, a method for automatically sending a security test email is provided, comprising:

[0047] Establish a communication connection with the receiving server;

[0048] Execute the MAIL FROM command to set the sender address used between servers during email transmission; execute the RCPT TO command to set the email address to which the email is actually delivered;

[0049] Execute the DATA command to send an automatically generated security test email to the receiving server;

[0050] Receive the status code returned by the receiving server to determine whether the email was sent successfully or failed. If the email fails to be sent, record the reason for the failure, switch to the backup SMTP server and try again. Retry up to N times. If it still fails, terminate and record the error, where N ≥ 3.

[0051] Preferably, establishing a communication connection with the receiving server includes:

[0052] Read the configuration to obtain the server address, port number, and protocol scheme of the receiving server;

[0053] According to the test requirements, check whether anonymous sending mode is used. If so, query the MX record of the receiving server and select the locally adapted SMTP server as the outgoing server. If not, directly use the pre-configured SMTP server as the outgoing server and authenticate with the account and password.

[0054] Execute the EHLO or HELO command to start email transmission;

[0055] After confirming that both the SMTP server and the recipient server support TLS through the EHLO or HELO command, the STARTTLS command is used to upgrade the original plaintext SMTP connection to an encrypted channel.

[0056] According to a third aspect of the present invention, there is provided a method for automatically detecting security test emails, applicable to a receiving server, comprising:

[0057] Initialize the email client: Obtain the necessary information required for the operation of the receiving server from the configuration file, user input or environment variables, including: the sending server address, port, account number, and password;

[0058] Dynamically select the corresponding protocol implementation class based on the user-configured protocol type and initialize an object of that class so that subsequent protocol-related operations can be performed through the object, including connecting to the outgoing mail server and sending and receiving mails.

[0059] Retrieve email metadata from the sending server or local storage to form a mail list, including: if the folder protocol is not supported, traverse the mails and filter them by receipt time; if the folder protocol is supported, scan the mails by folder category;

[0060] Parse the header of each email to extract the unique email identifier, receipt time, email storage and log records; record email scanning logs, including success, failure, and abnormal email information; and downgrade storage of emails that failed to be parsed to ensure data integrity.

[0061] Preferably, the email client includes at least:

[0062] Mail client base class (MailClient), POP3 protocol client (POPMailClient), IMAP protocol client (IMAPMailClient), EWS protocol client (EWSMailClient).

[0063] According to a fourth aspect of the present invention, there is provided a method for testing an email gateway vulnerability, comprising:

[0064] The above-mentioned method for automatically generating security test emails;

[0065] The above-mentioned method for automatically sending security test emails;

[0066] The above-mentioned automatic detection method of security test emails.

[0067] The technical solutions provided by the embodiments of the present invention may have the following beneficial effects:

[0068] The automatic security test email generation method provided by the present invention reduces manual operations: the automated system can quickly generate emails based on templates, avoiding manual modification of EML files and improving email construction efficiency. In addition, it supports batch email generation: a large number of emails can be constructed at one time, which is suitable for large-scale email testing or marketing activities. Furthermore, the flexible email construction method supports both EML file replacement and standardized construction modes to meet different email security testing business needs.

[0069] The method for automatically sending security test emails provided by the present invention follows the standard protocol-defined command sequence, and features a retry mechanism and link reuse logic, making it particularly advantageous for sending large numbers of emails in a short period of time. When sending anonymous emails, by querying the receiving server's MX record and selecting a locally adapted SMTP server as the sending server, the probability of emails being intercepted or classified as spam is reduced, thereby increasing the success rate of email delivery. Furthermore, the method for automatically sending security test emails provided by the present invention records detailed logs of email sending, receiving, and parsing, facilitating problem location and optimization.

[0070] The automatic detection method for security test emails provided by the present invention dynamically selects the corresponding protocol implementation class based on the protocol type configured by the user, and initializes an object of this class so that protocol-related operations can be subsequently performed through the object, including: connecting to the sending server, sending and receiving emails, so that email reception is compatible with multiple SMTP servers, and can ensure that the email system can run stably in the environments of different email service providers (such as Gmail, Outlook, and corporate email).

[0071] In summary, the present invention automatically generates a security test email in the first step, automatically sends a security test email in the second step, and automatically detects and matches the security test email in the third step to determine whether the email gateway has corresponding identification and processing behaviors, thereby verifying the security of the email gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a flow chart showing a method for automatically generating a security test email according to an exemplary embodiment;

[0073] Figure 2 This is a flow chart showing a method for automatically sending a security test email according to an exemplary embodiment;

[0074] Figure 3 The figure is a flowchart of a method for automatically detecting security test emails according to an exemplary embodiment. DETAILED DESCRIPTION

[0075] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0076] Example 1

[0077] Figure 1 This is a flow chart showing a method for automatically generating a security test email according to an exemplary embodiment. Figure 1 , the method comprising:

[0078] Step S11: generating a non-standardized custom email by parsing and modifying an existing EML file;

[0079] Step S12: Generate a standardized EML file by initializing the email constructor, constructing the email header, generating the email body, and adding attachments.

[0080] It should be noted that the standardized EML files mentioned in this embodiment refer to emails that comply with the MIME protocol. MIME protocol stands for Multipurpose Internet Mail Extensions. Non-standardized custom emails refer to emails that do not strictly comply with the MIME protocol.

[0081] It can be understood that the automatic security test email generation method provided by this embodiment reduces manual operations: the automated system can quickly generate emails based on templates, avoiding manual modification of EML files and improving email construction efficiency; in addition, it supports batch email generation: a large number of emails can be constructed at one time, which is suitable for large-scale email testing or marketing activities; furthermore, flexible email construction methods: supporting both EML file replacement and standardized construction modes, can meet different email security testing business needs.

[0082] In practice, in step S11, a non-standardized custom email is generated by parsing and modifying an existing EML file, including:

[0083] Step S111: read an existing EML file, parse the EML file using the Python email module, and obtain email metadata: email header, body, and / or attachments.

[0084] It should be noted that Python's email module is used to process emails, including parsing, generating, and sending emails. EML files are typically saved in the email format by email clients and contain information such as the email header, body, and attachments.

[0085] Headers: Email headers contain email metadata, such as sender, recipient, subject, and timestamp. Common header fields include: From (sender's address), To (recipient's address), Subject (email subject), Date (sending time), Message-ID (globally unique identifier to prevent duplicate email delivery), etc.

[0086] Body: The body of the email is the main content of the email and can be in plain text or HTML format.

[0087] Attachments: Attachments are additional files sent with emails, such as documents, pictures, etc.

[0088] Step S112: Parse the email header and modify the email header content to make it conform to the preset standard, including:

[0089] Parsing the email header and extracting at least the following fields: sender address, recipient address, sending time, and email subject;

[0090] When the email subject contains non-ASCII characters (such as Chinese, Japanese, special symbols, etc.), it is converted to Base64 encoding to ensure that the email header complies with the SMTP protocol specification and avoid email rejection or parsing errors caused by character encoding issues.

[0091] Check whether the unique identifier Message-ID in the email header is repeated. If so, modify the unique identifier Message-ID to ensure its uniqueness to avoid being identified as a duplicate email by the server and rejected or discarded.

[0092] Step S113: parsing the text and modifying the text content according to test requirements, including one or more of the following methods:

[0093] Replace the plain text content marked with a text modification mark in the body of the email based on the test requirements (for example, to generate a security test email with a phishing file, mark the name in the email body with a text modification mark, and pass in the name you want to replace during generation, such as replacing Zhang San with Li Si. This way, you can generate security test emails in batches);

[0094] According to the test requirements, replace the embedded image or QR code in the text, and update the reference relationship between the content identifier CID and the replaced embedded image or QR code.

[0095] Step S114: If the parsed email metadata contains attachments, keep the attachments unchanged or replace some of them according to the test requirements;

[0096] Step S115: Reconstruct the EML file based on the modified email header, body, and / or attachments;

[0097] Step S116: According to the test requirements, if the DKIM signature is enabled, the DKIM signature is inserted into the header field of the reconstructed EML file to generate the final customized email.

[0098] It's important to note that during email transmission, the Message-ID is a globally unique identifier for emails. It's used to prevent duplicate delivery, track email sources, and ensure compliance with email protocols. The following are typical scenarios and reasons for modifying the Message-ID:

[0099] (1) A unique Message-ID must be generated each time a new email is sent

[0100] When automated tools send test emails in batches (such as verification code emails and marketing emails), each email must have a unique Message-ID.

[0101] If the same Message-ID is used repeatedly, email servers (such as Gmail and Outlook) will identify it as a duplicate email and reject or discard it. This prevents email clients (such as Outlook and Foxmail) from displaying abnormal messages (such as duplicate counts and misordering) due to ID conflicts.

[0102] (2) Message-ID needs to be updated after the email content or metadata changes

[0103] After modifying key fields such as the email body, attachments, sender address (From), recipient address (To), etc.

[0104] Message IDs are typically generated based on a hash of the email content. Changes to the content will cause the hash to change, requiring an ID update. Forcing the old ID to remain may cause the email server to reject the message due to inconsistent content.

[0105] CID, short for Content-ID, is an identifier used in the email MIME protocol to uniquely identify embedded resources. In email, CID association is a mechanism for identifying and referencing embedded resources (such as images and QR codes). When email content contains embedded images or QR codes, CIDs are required to ensure that the resources load correctly; otherwise, the images may not display.

[0106] DKIM (DomainKeys Identified Mail) is an email authentication technology used to:

[0107] Verify sender identity: Confirm that the email actually comes from the domain it claims to be from.

[0108] Prevent email tampering: Detect whether emails have been modified during transmission.

[0109] Improve email credibility: Reduce the risk of spam / phishing emails.

[0110] In practice, step S12 generates a standardized EML file by initializing the email builder, constructing the email header, generating the email body, and adding attachments, including:

[0111] Step S121: Initialize the mail constructor and create an empty mail structure;

[0112] Step S122: Set the email header information: fill in the sender, recipient, and subject, and ensure that the format complies with the RFC 5322 standard;

[0113] Step S123: Generate a fixed-length unique identifier id_hash by performing hash calculation on the Message-ID, which is used to uniquely identify the email;

[0114] Step S124: insert the DKIM signature into the header field of the email header;

[0115] Step S125: Generate an email body in plain text format and / or HTML format according to the test requirements, including: if the QR code function is enabled in the email body, generate a QR code image and insert it into the HTML content; if the email body includes an image or hyperlink, ensure that the content identifier CID is correctly matched;

[0116] Step S126: Add attachments according to test requirements and selectively encrypt the attachments;

[0117] Step S127: Combine the constructed email header, email body, and attachments according to the MIME protocol, calculate the byte length of the email body and / or the byte length of the attachment, and insert the calculated byte length into the corresponding field of the email header for verification by the email recipient.

[0118] It's important to note that an email builder is a tool or code module used to create emails that conform to a standard format. Its core function is to assemble email content (such as the body, attachments, and recipient information) according to protocol specifications (such as SMTP and MIME), ultimately generating a ready-to-send email data packet. The email builder is a core component of the email system, responsible for converting user intent into protocol-compliant email data. Whether it's a simple text email or a complex, rich-media marketing email, the email builder must generate a standardized data packet.

[0119] The workflow of the email builder includes:

[0120] Initialize the mail object: Create an empty mail structure.

[0121] Set the email header: fill in sender, recipient, subject and other information.

[0122] Construct the body: Add plain text or HTML content. If there are attachments or multi-part content, use the multipart structure.

[0123] Encoding: Encode non-ASCII characters (such as UTF-8 with quoted-printable).

[0124] Encode the attachment in Base64 or binary format.

[0125] Generate email data: Serialize the email object into a string or byte stream in accordance with the SMTP / MIME protocol.

[0126] It is understood that the automatic generation method of security test emails provided in this embodiment supports the automatic generation of email bodies in plain text or HTML format, supports image embedding, and generates QR codes, enriching email content. It allows manual setting of email headers, providing flexible control over email field information. By hashing the Message-ID, a fixed-length unique identifier id_hash is generated to uniquely identify the email, prevent duplicate delivery, and track the email's flow. By inserting a DKIM signature into the header field of the email, the email is protected from tampering, improving the credibility of the email and reducing the probability of the automatically generated security test email being classified as spam by the receiving server. In addition, the technical solution provided in this embodiment supports attachment encryption and integrity verification, ensuring the security of sensitive information and preventing malicious tampering or interception.

[0127] Example 2

[0128] Figure 2 This is a flow chart showing a method for automatically sending a security test email according to an exemplary embodiment. Figure 2 , the method comprising:

[0129] Step S21: establishing a communication connection with the receiving server;

[0130] Step S22: Execute the MAIL FROM command to set the sender address used between servers during the email transmission process; execute the RCPT TO command to set the email address to which the email is actually delivered;

[0131] Step S23: Execute the DATA command to send the automatically generated security test email to the receiving server;

[0132] Step S24: Receive the status code returned by the receiving server and determine whether the sending is successful or failed; if the email fails to be sent, record the failure reason, switch to the backup SMTP server and try again; retry up to N times, and if it still fails, terminate and record the error, N≥3.

[0133] It should be noted that the technical solution provided in this embodiment is applied to the sending server.

[0134] The MAIL FROM command, RCPT TO command, and DATA command are all SMTP commands.

[0135] 1. MAIL FROM command: specifies the envelope sender of the email, that is, the sender address used between servers during email transmission.

[0136] 2. RCPT TO command: specifies the envelope recipient of the email, that is, the email address to which the email is actually to be delivered.

[0137] 3. DATA command: Begins the transmission of the actual email content (including headers and body). The server enters data receiving mode, waiting for the client to send the complete email content. The email content must conform to the MIME protocol format, including headers (such as Subject, From, and To) and the body (which may include attachments).

[0138] In practice, establishing a communication connection with the receiving server in step S21 includes:

[0139] Read the configuration to obtain the server address, port number, and protocol scheme of the receiving server;

[0140] According to the test requirements, check whether anonymous sending mode is used. If so, query the MX record of the receiving server and select the locally adapted SMTP server as the outgoing server. If not, directly use the pre-configured SMTP server as the outgoing server and authenticate with the account and password.

[0141] Execute the EHLO or HELO command to start email transmission;

[0142] After confirming that both the SMTP server and the recipient server support TLS through the EHLO or HELO command, the STARTTLS command is used to upgrade the original plaintext SMTP connection to an encrypted channel.

[0143] It's important to note that an MX record (Mail eXchanger Record) is a resource record in the DNS (Domain Name System) that specifies the mail server address responsible for receiving email for a domain. When someone sends email to a domain, the sender's mail server queries the domain's MX record to determine which mail server to route the email to.

[0144] The characteristics of anonymous email sending mode are: the sender hides his true identity (such as forging the From address, not using the real IP or SPF / DKIM signature). In this case, the receiving server will check whether the sender's domain name has a valid MX record:

[0145] If an MX record exists: the email may be marked as legitimate (but further SPF / DKIM verification is required).

[0146] If there is no MX record: The email may be directly rejected or marked as suspicious (for example, the sender claims to be from example.com, but there is no MX record for that domain).

[0147] That is, when sending normal emails, the MX record ensures that the email is routed to the correct recipient server (such as mail.example.com). When sending anonymous emails, the MX record helps the recipient verify the legitimacy of the sender's domain name, reducing the risk of spam.

[0148] EHLO and HELO are commands used in the Simple Mail Transfer Protocol (SMTP) to initiate email transmission sessions. Their core function is to announce the client's identity to the mail server and negotiate transmission capabilities. HELO is a fundamental command in the SMTP protocol, used by the client to identify itself (usually the sender's IP address or domain name) to the server and initiate email transmission. EHLO is an enhanced version of HELO, used to request server support for extended features (such as STARTTLS and DKIM).

[0149] The method for automatically sending a security test email provided in this embodiment also has error handling and log management functions, including:

[0150] Record errors that occur during the sending process;

[0151] Handle SMTP exceptions (such as sender rejection, recipient rejection, data errors, etc.);

[0152] Detailed logs recording the success or failure of email sending.

[0153] It is understood that the automatic security test email sending method provided by this embodiment reduces the probability of emails being intercepted or classified as spam and improves the successful delivery rate of emails by querying the receiving server's MX record and selecting a locally adapted SMTP server as the sending server when sending anonymous emails. Furthermore, the automatic security test email sending method provided by this embodiment records detailed logs of email sending, receiving, and parsing, facilitating problem location and optimization.

[0154] Example 3

[0155] Figure 3 This is a flow chart showing a method for automatically detecting security test emails according to an exemplary embodiment. Figure 3 , the method comprising:

[0156] Step S31, initializing the email client: obtaining the necessary information required for the operation of the receiving server from the configuration file, user input, or environment variables, including: the sending server address, port, account, and password (these parameters define how the email client establishes a connection with the sending server, verifies identity, and performs operations (such as sending and receiving emails));

[0157] Step S32: Dynamically select the corresponding protocol implementation class based on the protocol type configured by the user (e.g., IMAP, POP3, SMTP), and initialize an object of that class so that subsequent protocol-related operations can be performed through the object, including connecting to the outgoing mail server and sending and receiving mails.

[0158] Step S33: Retrieving email metadata from the sending server or local storage to form an email list, including: if the folder protocol is not supported (a folder protocol generally refers to a protocol that supports folder management on the email server side, for example, IMAP allows users to store, manage, and retrieve emails by folder classification. In contrast, "protocols that do not support folders" (such as POP3) can only filter emails by receipt time, not by folder classification), traversing the emails and filtering by receipt time; if the folder protocol is supported, scanning the emails by folder classification;

[0159] Step S34: Parse the header of each email to extract the unique email identifier, receipt time, email storage, and log records; record the email scanning log, including success, failure, and abnormal email information; downgrade the storage of emails that failed to parse to ensure data integrity (in the email processing system, downgrading the storage of emails that failed to parse is a fault-tolerant mechanism. Its core purpose is to retain data to the maximum extent possible when parsing anomalies, avoid information loss, and provide the possibility for subsequent repair or manual intervention).

[0160] It should be noted that the technical solution provided in this embodiment is applied to the receiving server. The email client is loaded and executed in the receiving server.

[0161] Preferably, the email client includes at least:

[0162] Mail client base class (MailClient), POP3 protocol client (POPMailClient), IMAP protocol client (IMAPMailClient), EWS protocol client (EWSMailClient).

[0163] It should be noted that:

[0164] 1. Mail client base class (MailClient), supports the following functions:

[0165] Centrally manage email connection configurations, such as server address, port, user credentials, etc.;

[0166] Provide logging function, support multiple loggers and set log timeout;

[0167] Parse email header information, obtain email receiving time, and support email unique identification check;

[0168] Maintains mail server connection and provides server refresh mechanism.

[0169] 2. POP3 protocol client (POPMailClient), supports the following functions:

[0170] Retrieve emails based on POP3 protocol;

[0171] Supports sorting of emails by receiving time and filtering out emails within a specific time range;

[0172] Use multiple connection attempts to improve the stability of server connections;

[0173] Parse email header information to obtain email subject, receiving time, etc.

[0174] Mail traversal is achieved through the scan_inbox method, and breakpoint resumption is supported.

[0175] 3. IMAP protocol client (IMAPMailClient), supports the following functions:

[0176] Obtain email lists based on the IMAP protocol and support multi-folder scanning;

[0177] Parse the email header information to obtain the email’s unique identifier and time;

[0178] Use regular expressions to match folder information returned by the IMAP server;

[0179] Use the scan_folder method to traverse emails and support retrying to retrieve abnormal emails.

[0180] 4. EWS protocol client (EWSMailClient), supports the following functions:

[0181] Obtain email lists based on the EWS protocol and support multi-folder scanning;

[0182] Parse the email header information to obtain the email’s unique identifier and time;

[0183] Use regular expressions to match folder information returned by the Exchange server;

[0184] Use the scan_folder method to traverse emails and support retrying to retrieve abnormal emails.

[0185] The automatic detection method for security test emails provided in this embodiment also has an intelligent log management function: it uses multiple loggers and supports a log timeout cleanup mechanism;

[0186] Record key events during the email scanning process, such as server connection failure, email parsing errors, etc.; provide add_logger method to support dynamic addition of loggers;

[0187] The automatic detection method for security test emails provided in this embodiment also has an email exception handling function:

[0188] Adopt exception capture mechanism to handle exceptions during email acquisition and parsing;

[0189] When the server connection fails, it automatically tries to reconnect and supports the maximum number of retries;

[0190] For emails that fail to parse, a downgrade solution is provided, such as storing the original email data for subsequent analysis.

[0191] It can be understood that the automatic detection method for security test emails provided in this embodiment dynamically selects the corresponding protocol implementation class according to the protocol type configured by the user, and initializes an object of this class so that protocol-related operations can be subsequently performed through the object, including: connecting to the sending server, sending and receiving emails, so that email reception can be compatible with multiple SMTP servers, and can ensure that the email system can run stably in different email service providers (such as Gmail, Outlook, and corporate email) environments.

[0192] Example 4

[0193] According to an exemplary embodiment, a method for testing an email gateway vulnerability is provided, including:

[0194] The above-mentioned method for automatically generating security test emails;

[0195] The above-mentioned method for automatically sending security test emails;

[0196] The above-mentioned automatic detection method of security test emails.

[0197] It can be understood that the automatic generation method of security test emails in this embodiment reduces manual operations: the automated system can quickly generate emails based on templates, avoiding manual modification of EML files and improving email construction efficiency; in addition, it supports batch email generation: a large number of emails can be built at one time, which is suitable for large-scale email testing or marketing activities; furthermore, the flexible email construction method: supports both EML file replacement and standardized construction modes, which can meet different email security testing business needs.

[0198] This method for automatically sending security test emails in this embodiment reduces the probability of emails being intercepted or classified as spam, thereby increasing the success rate of email delivery, by querying the receiving server's MX record and selecting a locally adapted SMTP server as the sending server when sending anonymous emails. Furthermore, this method for automatically sending security test emails in this embodiment records detailed logs of email sending, receiving, and parsing, facilitating problem location and optimization.

[0199] This automatic detection method for security test emails in this embodiment dynamically selects the corresponding protocol implementation class according to the protocol type configured by the user, and initializes an object of this class so that protocol-related operations can be subsequently performed through the object, including: connecting to the sending server, sending and receiving emails, so that email reception can be compatible with multiple SMTP servers, and can ensure that the email system can run stably in the environments of different email service providers (such as Gmail, Outlook, and corporate email).

[0200] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0201] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above-mentioned computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application.

[0202] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0203] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, and can be electrical or other forms.

[0204] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0205] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0206] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for automatically generating a security test email, characterized in that: include: Generate non-standardized custom emails by parsing and modifying existing EML files; Generate a standardized EML file by initializing the email builder, constructing the email header, generating the email body, and adding attachments; The process of generating a non-standardized custom email by parsing and modifying an existing EML file includes: Read an existing EML file and parse it using Python's email module to obtain email metadata: email headers, body, and / or attachments. Parsing the email header and modifying the email header content to make it conform to preset standards; Parse the text and modify the content according to test requirements; If the parsed email metadata contains attachments, keep the attachments unchanged or replace some of them based on the test requirements; Reconstruct the EML file based on the modified email header, body, and / or attachments; According to the test requirements, if DKIM signature is enabled, insert the DKIM signature into the header field of the reconstructed EML file to generate the final customized email; The steps of generating a standardized EML file by initializing an email builder, constructing an email header, generating an email body, and adding attachments include: Initialize the mail constructor and create an empty mail structure; Set the email header information: fill in the sender, recipient, and subject; By performing hash calculation on the Message-ID, a fixed-length unique identifier id_hash is generated to uniquely identify the email; Insert DKIM signature in the header field of the email; Generate email body in plain text format and / or HTML format according to test requirements; Add attachments according to test requirements and selectively encrypt them; The constructed email header, email body and attachments are combined according to the MIME protocol, and the byte length of the email body and / or the byte length of the attachments are calculated. The calculated byte lengths are inserted into the corresponding fields of the email header for verification by the email recipient.

2. The method according to claim 1, characterized in that The parsing of the email header and modifying the email header content to make it conform to a preset standard includes: Parsing the email header and extracting at least the following fields: sender address, recipient address, sending time, and email subject; When the email subject contains non-ASCII characters, it is converted to Base64 encoding to ensure that the email header complies with the SMTP protocol specification and avoid email rejection or parsing errors caused by character encoding issues. Check whether the unique identifier Message-ID in the email header is repeated. If so, modify the unique identifier Message-ID to ensure its uniqueness to avoid being identified as a duplicate email by the server and rejected or discarded.

3. The method according to claim 1, characterized in that The parsing of the text and modifying the text content according to the test requirements may include one or more of the following methods: According to the test requirements, replace the plain text content marked with text modification in the text; According to the test requirements, replace the embedded image or QR code in the text, and update the reference relationship between the content identifier CID and the replaced embedded image or QR code.

4. A method for automatically sending a security test email, suitable for use in a sending server, characterized in that: include: Generating a security test email according to the method according to any one of claims 1 to 3; Establish a communication connection with the receiving server; Execute the MAIL FROM command to set the sender address used between servers during email transmission; execute the RCPTTO command to set the email address to which the email is actually delivered; Execute the DATA command to send an automatically generated security test email to the receiving server; Receive the status code returned by the receiving server to determine whether the email was sent successfully or failed. If the email fails to be sent, record the reason for the failure, switch to the backup SMTP server and try again. Retry up to N times. If it still fails, terminate and record the error, where N ≥ 3.

5. The method according to claim 4, characterized in that The establishing of a communication connection with the receiving server includes: Read the configuration to obtain the server address, port number, and protocol scheme of the receiving server; According to the test requirements, check whether anonymous sending mode is used. If so, query the MX record of the receiving server and select the locally adapted SMTP server as the outgoing server. If not, directly use the pre-configured SMTP server as the outgoing server and authenticate with the account and password. Execute the EHLO or HELO command to start email transmission; After confirming that both the SMTP server and the recipient server support TLS through the EHLO or HELO command, the STARTTLS command is used to upgrade the original plaintext SMTP connection to an encrypted channel.

6. A method for automatically detecting security test emails, characterized in that: include: The sending server sends a security test email according to the method according to any one of claims 4 to 5; The receiving server initializes the email client: it obtains the necessary information required for the operation of the receiving server from the configuration file, user input or environment variables, including: the sending server address, port, account number and password; The receiving server dynamically selects the corresponding protocol implementation class based on the protocol type configured by the user and initializes an object of this class so that subsequent protocol-related operations can be performed through this object, including connecting to the sending server and sending and receiving emails. The receiving server retrieves the metadata of the email from the sending server or local storage to form a mail list, including: if the folder protocol is not supported, traversing the emails and filtering them by receiving time; if the folder protocol is supported, scanning the emails by folder category; The receiving server parses the header of each email, extracts the email's unique identifier, receipt time, email storage and log records; records email scanning logs, including success, failure, and abnormal email information; and downgrades the storage of emails that fail to be parsed to ensure data integrity.

7. The method according to claim 6, characterized in that The email client at least includes: Mail client base class, POP3 protocol client, IMAP protocol client, EWS protocol client.

8. A method for testing email gateway vulnerabilities, characterized in that: include: The method for automatically generating a security test email according to any one of claims 1 to 3; The method for automatically sending a security test email according to any one of claims 4-5; The automatic detection method for security test emails as described in any one of claims 6-7.

Images