← retour aux outils back to tools

# sendemail

Envoyeur d'e-mails en ligne de commande via SMTP. Envoie des e-mails avec pièces jointes, contenu HTML et en-têtes personnalisés directement depuis le terminal : utile pour les simulations de phishing, les tests d'alertes et les vérifications de relais SMTP. Command-line email sender via SMTP. Sends emails with attachments, HTML content, and custom headers directly from the terminal — useful for phishing simulations, alert testing, and SMTP relay checks.

↗ https://github.com/mogaal/sendemail

## Overview

sendEmail is a lightweight command-line email sending tool. It sends emails via SMTP from the command line with support for attachments, HTML, authentication, TLS, and custom headers — useful for phishing simulations and testing email security controls.

## Basic Usage

Send a simple email

    sendEmail -f from@example.com \
      -t victim@target.com \
      -u "Subject Line" \
      -m "Message body" \
      -s mail.example.com

Send with authentication

    sendEmail -f from@example.com \
      -t victim@target.com \
      -u "Subject" \
      -m "Body" \
      -s smtp.gmail.com:587 \
      -xu username -xp password

Send with STARTTLS

    sendEmail -f from@example.com \
      -t victim@target.com \
      -u "Subject" \
      -m "Body" \
      -s smtp.gmail.com:587 \
      -xu user -xp pass \
      -o tls=yes

## HTML Email

Send HTML email

    sendEmail -f sender@domain.com \
      -t target@company.com \
      -u "IT Security Alert" \
      -m "<html><body><h1>Your password expires today</h1><a href='http://phishing.test/reset'>Reset Here</a></body></html>" \
      -o message-content-type=html \
      -s mail.domain.com

## Attachments

Send with attachment

    sendEmail -f sender@domain.com \
      -t victim@target.com \
      -u "Invoice Q4" \
      -m "Please see attached" \
      -a /path/to/invoice.pdf \
      -s mail.domain.com

Multiple attachments

    sendEmail -f sender@domain.com \
      -t victim@target.com \
      -u "Documents" \
      -m "See attached" \
      -a doc1.pdf doc2.docx \
      -s mail.domain.com

## Spoofing and Headers

Spoof From header

    sendEmail -f "CEO <ceo@company.com>" \
      -t employee@company.com \
      -u "Urgent Wire Transfer" \
      -m "Please process immediately" \
      -s mail.attacker.com

Add custom headers

    sendEmail -f from@domain.com \
      -t target@company.com \
      -u "Subject" \
      -m "Body" \
      -o message-header="X-Priority: 1" \
      -s smtp.server.com

## Open Relay Testing

Test if SMTP server is an open relay

    sendEmail -f fake@random.com \
      -t external@gmail.com \
      -u "Test" \
      -m "Relay test" \
      -s target-smtp.company.com

    # If it succeeds → open relay (vulnerability!)

## Tips

- SPF/DKIM/DMARC will block spoofed emails on well-configured mail servers
- Use for testing whether your own mail filters catch phishing attempts
- The `-o tls=yes` flag enables STARTTLS; `-o tls=auto` negotiates automatically
- Combine with swaks for more detailed SMTP transaction inspection
- For real phishing simulations, use frameworks like Gophish

Help / Man page

    sendEmail [options]

    -f ADDR     From address
    -t ADDR     To address(es)
    -cc ADDR    CC address(es)
    -bcc ADDR   BCC address(es)
    -u SUBJ     Subject
    -m MSG      Message body
    -a FILE     Attachment(s)
    -s SERVER   SMTP server[:port]
    -xu USER    SMTP authentication username
    -xp PASS    SMTP authentication password
    -o OPTION   Extended options:
                  tls=yes/no/auto
                  message-content-type=html
                  message-header=HEADER

## Vue d’ensemble

sendEmail est un outil léger d’envoi d’e-mails en ligne de commande. Il envoie des e-mails via SMTP depuis le terminal avec support des pièces jointes, du HTML, de l’authentification, du TLS et des en-têtes personnalisés : utile pour les simulations de phishing et le test des contrôles de sécurité des e-mails.

## Utilisation de base

    # Envoyer un e-mail simple
    sendEmail -f from@example.com \
      -t victim@target.com \
      -u "Subject Line" \
      -m "Message body" \
      -s mail.example.com

    # Envoyer avec authentification
    sendEmail -f from@example.com \
      -t victim@target.com \
      -u "Subject" \
      -m "Body" \
      -s smtp.gmail.com:587 \
      -xu username -xp password

    # Envoyer avec STARTTLS
    sendEmail -f from@example.com \
      -t victim@target.com \
      -u "Subject" \
      -m "Body" \
      -s smtp.gmail.com:587 \
      -xu user -xp pass \
      -o tls=yes

## E-mail HTML

    # Envoyer un e-mail HTML
    sendEmail -f sender@domain.com \
      -t target@company.com \
      -u "IT Security Alert" \
      -m "<html><body><h1>Your password expires today</h1><a href='http://phishing.test/reset'>Reset Here</a></body></html>" \
      -o message-content-type=html \
      -s mail.domain.com

## Pièces jointes

    # Envoyer avec pièce jointe
    sendEmail -f sender@domain.com \
      -t victim@target.com \
      -u "Invoice Q4" \
      -m "Please see attached" \
      -a /path/to/invoice.pdf \
      -s mail.domain.com

    # Pièces jointes multiples
    sendEmail -f sender@domain.com \
      -t victim@target.com \
      -u "Documents" \
      -m "See attached" \
      -a doc1.pdf doc2.docx \
      -s mail.domain.com

## Spoofing et en-têtes

    # Usurper l'en-tête From
    sendEmail -f "CEO <ceo@company.com>" \
      -t employee@company.com \
      -u "Urgent Wire Transfer" \
      -m "Please process immediately" \
      -s mail.attacker.com

    # Ajouter des en-têtes personnalisés
    sendEmail -f from@domain.com \
      -t target@company.com \
      -u "Subject" \
      -m "Body" \
      -o message-header="X-Priority: 1" \
      -s smtp.server.com

## Test de relais ouvert

    # Tester si un serveur SMTP est un relais ouvert
    sendEmail -f fake@random.com \
      -t external@gmail.com \
      -u "Test" \
      -m "Relay test" \
      -s target-smtp.company.com

    # Si ça réussit -> relais ouvert (vulnérabilité !)

## Conseils

- SPF/DKIM/DMARC bloqueront les e-mails usurpés sur les serveurs de messagerie bien configurés
- À utiliser pour tester si vos propres filtres de messagerie détectent les tentatives de phishing
- Le flag `-o tls=yes` active STARTTLS ; `-o tls=auto` négocie automatiquement
- Combiner avec swaks pour une inspection plus détaillée des transactions SMTP
- Pour de véritables simulations de phishing, utiliser des frameworks comme Gophish

Aide / Page de manuel

    sendEmail [options]

    -f ADDR     From address
    -t ADDR     To address(es)
    -cc ADDR    CC address(es)
    -bcc ADDR   BCC address(es)
    -u SUBJ     Subject
    -m MSG      Message body
    -a FILE     Attachment(s)
    -s SERVER   SMTP server[:port]
    -xu USER    SMTP authentication username
    -xp PASS    SMTP authentication password
    -o OPTION   Extended options:
                  tls=yes/no/auto
                  message-content-type=html
                  message-header=HEADER