retour aux outils back to tools Ducklings

sendemail

Envoyeur d'e-mails en ligne de commande via SMTP. Envoie des e-mails avec pièces jointes, contenu HTML et en-têtes personnalisés directement depuis le terminal : utile pour les simulations de phishing, les tests d'alertes et les vérifications de relais SMTP. Command-line email sender via SMTP. Sends emails with attachments, HTML content, and custom headers directly from the terminal — useful for phishing simulations, alert testing, and SMTP relay checks.

↗ https://github.com/mogaal/sendemail

Overview

sendEmail is a lightweight command-line email sending tool. It sends emails via SMTP from the command line with support for attachments, HTML, authentication, TLS, and custom headers — useful for phishing simulations and testing email security controls.

Basic Usage

Send a simple email

sendEmail -f from@example.com \
  -t victim@target.com \
  -u "Subject Line" \
  -m "Message body" \
  -s mail.example.com

Send with authentication

sendEmail -f from@example.com \
  -t victim@target.com \
  -u "Subject" \
  -m "Body" \
  -s smtp.gmail.com:587 \
  -xu username -xp password

Send with STARTTLS

sendEmail -f from@example.com \
  -t victim@target.com \
  -u "Subject" \
  -m "Body" \
  -s smtp.gmail.com:587 \
  -xu user -xp pass \
  -o tls=yes

HTML Email

Send HTML email

sendEmail -f sender@domain.com \
  -t target@company.com \
  -u "IT Security Alert" \
  -m "<html><body><h1>Your password expires today</h1><a href='http://phishing.test/reset'>Reset Here</a></body></html>" \
  -o message-content-type=html \
  -s mail.domain.com

Attachments

Send with attachment

sendEmail -f sender@domain.com \
  -t victim@target.com \
  -u "Invoice Q4" \
  -m "Please see attached" \
  -a /path/to/invoice.pdf \
  -s mail.domain.com

Multiple attachments

sendEmail -f sender@domain.com \
  -t victim@target.com \
  -u "Documents" \
  -m "See attached" \
  -a doc1.pdf doc2.docx \
  -s mail.domain.com

Spoofing and Headers

Spoof From header

sendEmail -f "CEO <ceo@company.com>" \
  -t employee@company.com \
  -u "Urgent Wire Transfer" \
  -m "Please process immediately" \
  -s mail.attacker.com

Add custom headers

sendEmail -f from@domain.com \
  -t target@company.com \
  -u "Subject" \
  -m "Body" \
  -o message-header="X-Priority: 1" \
  -s smtp.server.com

Open Relay Testing

Test if SMTP server is an open relay

sendEmail -f fake@random.com \
  -t external@gmail.com \
  -u "Test" \
  -m "Relay test" \
  -s target-smtp.company.com
# If it succeeds → open relay (vulnerability!)

Tips

  • SPF/DKIM/DMARC will block spoofed emails on well-configured mail servers
  • Use for testing whether your own mail filters catch phishing attempts
  • The -o tls=yes flag enables STARTTLS; -o tls=auto negotiates automatically
  • Combine with swaks for more detailed SMTP transaction inspection
  • For real phishing simulations, use frameworks like Gophish
Help / Man page 
sendEmail [options]

-f ADDR     From address
-t ADDR     To address(es)
-cc ADDR    CC address(es)
-bcc ADDR   BCC address(es)
-u SUBJ     Subject
-m MSG      Message body
-a FILE     Attachment(s)
-s SERVER   SMTP server[:port]
-xu USER    SMTP authentication username
-xp PASS    SMTP authentication password
-o OPTION   Extended options:
              tls=yes/no/auto
              message-content-type=html
              message-header=HEADER

Vue d’ensemble

sendEmail est un outil léger d’envoi d’e-mails en ligne de commande. Il envoie des e-mails via SMTP depuis le terminal avec support des pièces jointes, du HTML, de l’authentification, du TLS et des en-têtes personnalisés : utile pour les simulations de phishing et le test des contrôles de sécurité des e-mails.

Utilisation de base

# Envoyer un e-mail simple
sendEmail -f from@example.com \
  -t victim@target.com \
  -u "Subject Line" \
  -m "Message body" \
  -s mail.example.com

# Envoyer avec authentification
sendEmail -f from@example.com \
  -t victim@target.com \
  -u "Subject" \
  -m "Body" \
  -s smtp.gmail.com:587 \
  -xu username -xp password

# Envoyer avec STARTTLS
sendEmail -f from@example.com \
  -t victim@target.com \
  -u "Subject" \
  -m "Body" \
  -s smtp.gmail.com:587 \
  -xu user -xp pass \
  -o tls=yes

E-mail HTML

# Envoyer un e-mail HTML
sendEmail -f sender@domain.com \
  -t target@company.com \
  -u "IT Security Alert" \
  -m "<html><body><h1>Your password expires today</h1><a href='http://phishing.test/reset'>Reset Here</a></body></html>" \
  -o message-content-type=html \
  -s mail.domain.com

Pièces jointes

# Envoyer avec pièce jointe
sendEmail -f sender@domain.com \
  -t victim@target.com \
  -u "Invoice Q4" \
  -m "Please see attached" \
  -a /path/to/invoice.pdf \
  -s mail.domain.com

# Pièces jointes multiples
sendEmail -f sender@domain.com \
  -t victim@target.com \
  -u "Documents" \
  -m "See attached" \
  -a doc1.pdf doc2.docx \
  -s mail.domain.com

Spoofing et en-têtes

# Usurper l'en-tête From
sendEmail -f "CEO <ceo@company.com>" \
  -t employee@company.com \
  -u "Urgent Wire Transfer" \
  -m "Please process immediately" \
  -s mail.attacker.com

# Ajouter des en-têtes personnalisés
sendEmail -f from@domain.com \
  -t target@company.com \
  -u "Subject" \
  -m "Body" \
  -o message-header="X-Priority: 1" \
  -s smtp.server.com

Test de relais ouvert

# Tester si un serveur SMTP est un relais ouvert
sendEmail -f fake@random.com \
  -t external@gmail.com \
  -u "Test" \
  -m "Relay test" \
  -s target-smtp.company.com

# Si ça réussit -> relais ouvert (vulnérabilité !)

Conseils

  • SPF/DKIM/DMARC bloqueront les e-mails usurpés sur les serveurs de messagerie bien configurés
  • À utiliser pour tester si vos propres filtres de messagerie détectent les tentatives de phishing
  • Le flag -o tls=yes active STARTTLS ; -o tls=auto négocie automatiquement
  • Combiner avec swaks pour une inspection plus détaillée des transactions SMTP
  • Pour de véritables simulations de phishing, utiliser des frameworks comme Gophish
Aide / Page de manuel 
sendEmail [options]

-f ADDR     From address
-t ADDR     To address(es)
-cc ADDR    CC address(es)
-bcc ADDR   BCC address(es)
-u SUBJ     Subject
-m MSG      Message body
-a FILE     Attachment(s)
-s SERVER   SMTP server[:port]
-xu USER    SMTP authentication username
-xp PASS    SMTP authentication password
-o OPTION   Extended options:
              tls=yes/no/auto
              message-content-type=html
              message-header=HEADER