How to spoof an email without software

[holmedog]

I didn't write this guide, and to be honest I don't want credit for posting this. I'm just getting tired of everyone not knowing what/how email spoofing works, or exactly how simple it is. So, without further ado:

DataStronghold.com - How to Spoof an Email Without Software

So you want to play a trick on a friend?  Here is an easy way to spoof an email address from within his own company. And him looking at the internet headers won't save him ;-)

So many times I hear people asking how to spoof an email sender address.  This is a relatively easy task but I find so many false advertisements for software that say they can do it.  Also this method is a bit different than using software to do it since if someone tries to determine that it is fake it will actually say it is from the proper email server.  
This method will only work by spoofing email to and from people in the same organization, which in reality can be the most damaging ;-)
So lets start out with a little back story:
“Friend A” has decided to play a trick on “Friend B”, by sending a notice to “Friend B” that he has been fired from “Company A” by his boss.  So how will we be able to do this?  Easy we are going to send an email via Telnet!
So the first order of business is to find out what the email server address of “Company A” is.  We can do this by locating the MX or Mail Exchange record of “Company A”  To do this we can perform a nslookup query from the command line but sometimes it is easier to use a website for you new guys.  So go here:
http://centralops.net/co/DomainDossier.aspx
Then type in the domain name of “Company A”  which if your friend email address was [email protected], it would be companya.com.  Then check the box next to “DNS Records”
Now after doing this you will see a whole slue of information, what we are looking for are the records labeled “MX”  there will be more then one, which is fine.  The one we are interested in is the one with the lowest number, which indicates it is the primary MX for the company.  Now take the name of the mail server.  For our purposes we are going to assume the name of the server is mail.companya.com and next open your favorite command line or terminal utility.  In windows you get there by clicking “Start” then “Run” and then typing “cmd”. Next you will type the following

> telnet mail.companya.com 25 

Telnet is the application we are going to use but in this case we are connecting to port 25 and not to the normal telnet port of 23.  Port 25 is used for SMTP or the protocol used for email.
You should get the following response back if you are connecting to an exchange server.
220 mail.companya.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready at  Tue, 19 Feb 2005 14:44:12 -0500 

Now you should type the following
  > helo companya.com 


The server should respond that helo back.  Next type in the following:
   > mail from: [email protected]
This tells the server that you want to send email from the bosses account. Next type:
> rcpt to: [email protected] 
 
This is your friends email address.  And next type:
> data 

This sets the system to get ready for you to begin writing your message.  Now start typing what you want to say:
> Friend B, I am tired of your constant watching of penny arcade video’s and now you are fired. 
 
Once you are done writing your message hit enter, then type a period “.” And then hit enter again.  It will store and then save your message sending it to your friend.  Now that is what I call funny!

[doubledown]

Hi,
the thing is, for this to work, you have to be on the same network as the person you want to send a spoofed mail, because most of the newer mail servers won't let you enter the sender address manually anymore.
Couple years ago you could just randomly pick a mail server and telnet to it and fake the email-address what ever way you wanted it to be. This has been fixed, though.
As was pointed out in the text, you have to be on the same network as your victim, which makes this procedure kinda useless.
You can still spoof mails quite easily using certain remailers.

[outcast]

Actually, theres plenty of providers still out there that do not require the reciever to be on the same domain.. if u know where to look lol.

[Firefly192]

Some providers (like mine) block port 25 and 220 (for "security reasons...") so you can only send and receive e-mail from your own provider (with telnet protocol I mean)... Sometimes they unblock the ports if you ask them though, but not always.

So if your provider blocks port 25 and 220, try connecting to the provider e-mail system (if they have one).