TDCTF Academy Logo TDCTF ACADEMY
@farishhz

Lab 10: Email Forensics - Menganalisis Header Email untuk Mendeteksi Phishing & Spoofing

Target Skill: Mahasiswa mampu menganalisis header email mentah untuk mendeteksi phishing, email spoofing, dan menelusuri asal email
Tools: python3, grep, openssl, dig
Durasi: 30 menit
Level: Beginner

Mengapa Email Forensics Penting?

Email adalah vektor serangan #1 di dunia:

  • 91% serangan cyber dimulai dari email phishing
  • 3.4 miliar email phishing dikirim setiap hari
  • Kerugian global akibat BEC (Business Email Compromise) mencapai $50 miliar

Email forensics membantu investigator menjawab:

  • Siapa pengirim sebenarnya? (bukan yang terlihat di "From:")
  • Dari mana email ini berasal? (IP, server asal)
  • Apakah email asli atau spoofed?
  • Kemana link ini mengarah?

Learning Objectives

  1. Memahami struktur header email (SMTP, MIME, Received)
  2. Mengekstrak IP asli pengirim dari header Received
  3. Menganalisis SPF, DKIM, DMARC records
  4. Mendeteksi email phishing dan spoofing
  5. Melakukan email tracking analysis

️ Tools & Setup

dig  # sudah bawaan Linux
which dig || sudo apt install -y dnsutils

Langkah Praktikum

Step 1: Teori - Struktur Header Email

cd ~ && mkdir forensics-lab10 && cd forensics-lab10

echo "=== Struktur Header Email ==="
cat << 'INFO'
Header email terdiri dari beberapa bagian:

1. HEADER BIASA (tampil di client email):
   From: - pengirim (BISA DIPALSUKAN!)
   To: - penerima
   Subject: - judul
   Date: - waktu kirim

2. HEADER SMTP (mentah - bisa dipercaya):
   Received: - setiap server yang dilewati (baca dari BAWAH ke ATAS)
   Return-Path: - alamat pengirim asli (bounce address)
   Message-ID: - ID unik email
   Authentication-Results: - hasil SPF/DKIM/DMARC

3. HEADER KEAMANAN:
   SPF: - apakah IP pengirim diizinkan?
   DKIM: - apakah tanda tangan digital valid?
   DMARC: - kebijakan domain (apa yang harus dilakukan jika gagal?)

Aturan emas: BACA HEADER DARI BAWAH KE ATAS!
INFO

Step 2: Buat Sample Email - Email Normal

# Email asli dari Google
cat > email-normal.eml << 'EMAIL'
Return-Path: <[email protected]>
Received: from mail.company.com (192.168.1.10) by mail.google.com with SMTP id abc123;
        Thu, 18 Jun 2026 09:30:00 +0700
Received: from smtp.company.com (10.0.0.1) by mail.company.com with ESMTP id xyz789;
        Thu, 18 Jun 2026 09:29:45 +0700
Received: from desktop.company.com (192.168.1.100) by smtp.company.com with ESMTP id mno456;
        Thu, 18 Jun 2026 09:29:30 +0700
DKIM-Signature: v=1; a=rsa-sha256; d=company.com; s=selector1;
        bh=abc123def456...;
        h=from:to:subject:date;
        b=valid_signature_here...
From: Andi Pratama <[email protected]>
To: Budi <[email protected]>
Subject: Laporan Q2 2026
Date: Thu, 18 Jun 2026 09:29:30 +0700
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain

Halo Budi,

Berikut laporan Q2 yang sudah selesai.
Silakan cek attachment.

Terima kasih,
Andi
EMAIL

echo "✅ email-normal.eml - email legitimate dari company.com"

Step 3: Buat Sample Email - Email Phishing

# Email phishing - mencoba memalsukan bank
cat > email-phishing.eml << 'EMAIL'
Return-Path: <[email protected]>
Received: from spam-server.attacker.com (203.0.113.5) by mail.google.com with SMTP id hacked789;
        Thu, 18 Jun 2026 08:15:00 +0700
Received: from relay.attacker.com (10.100.0.1) by spam-server.attacker.com with ESMTP id payload01;
        Thu, 18 Jun 2026 08:14:45 +0700
DKIM-Signature: v=1; a=rsa-sha256; d=attacker-mail.com; s=mail;
        bh=...;
        h=from:to:subject:date;
        b=invalid_or_missing...
From: Bank BCA <[email protected]>
To: [email protected]
Subject: Peringatan Keamanan - Akun Anda Diblokir!
Date: Thu, 18 Jun 2026 08:14:30 +0700
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/html

<html>
<body>
<h2>Akun Bank BCA Anda Diblokir!</h2>
<p>Kami mendeteksi aktivitas mencurigakan pada akun Anda.</p>
<p>Silakan verifikasi akun Anda segera:</p>
<a href="http://phishing-bca-login.com/verifikasi">https://bca.co.id/verifikasi</a>
<p>Jika tidak diverifikasi dalam 24 jam, akun akan ditutup.</p>
<p style="color:gray">BCA Security Team</p>
</body>
</html>
EMAIL

echo "✅ email-phishing.eml - email phishing berpura-pura dari BCA"

Step 4: Analisis Received Header - Lacak Asal Email

# 1. Analisis header Received (baca dari BAWAH ke ATAS)
echo "=== Email Normal - Received Chain ==="
echo "Baca dari BAWAH ke ATAS:"
grep "^Received:" email-normal.eml | nl

echo ""
echo "=== Email Phishing - Received Chain ==="
echo "Baca dari BAWAH ke ATAS:"
grep "^Received:" email-phishing.eml | nl

echo ""
echo "📌 ANALISIS:"
echo "Normal: desktop(192.168.1.100) → smtp.company.com → mail.company.com → Gmail"
echo "        Semua server dikenal, domain konsisten."
echo ""
echo "Phishing: relay.attacker.com(10.100.0.1) → spam-server.attacker.com → Gmail"
echo "        🚩 Server asal = 203.0.113.5 (bukan IP bank!)"
echo "        🚩 Domain = attacker-mail.com (bukan bca.co.id)"

Step 5: Ekstrak Return-Path vs From

echo "=== Return-Path vs From: ==="
echo ""
echo "--- Email Normal ---"
echo "Return-Path: $(grep -i "^return-path:" email-normal.eml | sed 's/.*: //')"
echo "From:        $(grep -i "^from:" email-normal.eml | sed 's/.*: //')"
echo "Domain:      SAMA ✅ - legitimate"
echo ""
echo "--- Email Phishing ---"
echo "Return-Path: $(grep -i "^return-path:" email-phishing.eml | sed 's/.*: //')"
echo "From:        $(grep -i "^from:" email-phishing.eml | sed 's/.*: //')"
echo "Domain:      BEDA 🚩 - spoofing!"
echo ""
echo "📌 Return-Path = [email protected] (pengirim ASLI)"
echo "📌 From = [email protected] (palsu/dispoof)"

Step 6: Analisis SPF, DKIM, DMARC

SPF, DKIM, DMARC adalah 3 lapis pertahanan email authentication:

echo "=== Email Authentication Analysis ==="

# Simulasi SPF check
echo ""
echo "--- SPF (Sender Policy Framework) ---"
echo "Cek: apakah IP pengirim diizinkan oleh domain?"
echo ""
echo "Email Normal: SPF pass ✅ (192.168.1.10 terdaftar di DNS company.com)"
echo "Email Phishing: SPF fail 🚩 (203.0.113.5 TIDAK terdaftar di DNS bca.co.id)"

# Simulasi DKIM check
echo ""
echo "--- DKIM (DomainKeys Identified Mail) ---"
echo "Cek: apakah tanda tangan digital valid?"
echo ""
echo "Email Normal: DKIM pass ✅ (tanda tangan valid untuk company.com)"
echo "Email Phishing: DKIM fail 🚩 (tanda tangan untuk attacker-mail.com, bukan bca.co.id!)"

# Simulasi DMARC check
echo ""
echo "--- DMARC (Domain-based Message Auth) ---"
echo "Kebijakan domain: apa yang harus dilakukan jika SPF/DKIM gagal?"
echo ""
echo "bca.co.id DMARC policy: p=reject (tolak jika gagal)"
echo "🚩 Email phishing harusnya DITOLAK oleh Gmail, tapi lolos..."
echo "   Kemungkinan: attacker gunakan teknik bypass atau domain terkenal"
# 7. Ekstrak link dari email
echo "=== Link Analysis ==="
echo ""
echo "--- Email Phishing: Link yang terlihat ---"
echo "https://bca.co.id/verifikasi"
echo ""
echo "--- Tapi link ASLI (href) ---"
echo "http://phishing-bca-login.com/verifikasi"
echo ""
echo "📌 Teknik: display text 'bca.co.id' tapi href ke 'phishing-bca-login.com'"
echo "📌 Ini adalah teknik paling umum di email phishing!"

Step 8: Praktik - Verifikasi Domain dengan dig

echo "=== Verifikasi DNS Records ==="
echo ""

# Di dunia nyata, kita cek SPF & DMARC dengan dig:
echo "1. Cek SPF record bca.co.id (simulasi):"
echo "$ dig txt bca.co.id | grep spf"
echo "   v=spf1 ip4:103.10.XX.XX include:_spf.bca.co.id ~all"
echo "   ❌ IP 203.0.113.5 tidak ada dalam daftar SPF!"
echo ""
echo "2. Cek DMARC record:"
echo "$ dig txt _dmarc.bca.co.id"
echo "   v=DMARC1; p=reject; rua=mailto:[email protected]"
echo "   ✅ DMARC policy = reject (harus tolak email mencurigakan)"
echo ""
echo "3. Cek MX record domain attacker:"
echo "$ dig mx attacker-mail.com"
echo "   ➡ 203.0.113.5 (server di hosting murah / negara dengan regulasi longgar)"

Step 9: Analisis Email Lengkap

# Script analisis otomatis
python3 << 'PYEOF'
import re, sys

def analyze_email(filepath):
    with open(filepath) as f:
        content = f.read()
    
    findings = []
    
    # 1. Extract headers
    received = re.findall(r'^Received:.*?from\s+(\S+)\s+\((\d+\.\d+\.\d+\.\d+)\)', content, re.M)
    return_path = re.search(r'^Return-Path:.*?<([^>]+)>', content, re.M)
    from_addr = re.search(r'^From:.*?<([^>]+)>', content, re.M)
    dkim_d = re.search(r'd=([a-z0-9.-]+)', content)
    
    # 2. Check spoofing
    if return_path and from_addr:
        rp_domain = return_path.group(1).split('@')[1]
        from_domain = from_addr.group(1).split('@')[1]
        if rp_domain != from_domain:
            findings.append(f"🚩 SPOOFING: Return-Path domain ({rp_domain}) != From domain ({from_domain})")
    
    # 3. Check DKIM
    if dkim_d:
        if from_addr:
            from_domain = from_addr.group(1).split('@')[1]
            if dkim_d.group(1) != from_domain:
                findings.append(f"🚩 DKIM MISMATCH: DKIM domain ({dkim_d.group(1)}) != From domain ({from_domain})")
    
    # 4. Analyze received chain
    if received:
        origin_ip = received[-1][1]  # IP paling awal (server asli)
        origin_host = received[-1][0]
        findings.append(f"📌 Origin server: {origin_host} ({origin_ip})")
    
    # 5. Check phishing indicators
    if 'href=' in content or 'http://' in content:
        links = re.findall(r'href=["\'](https?://[^"\']+)', content)
        for link in links:
            if 'http://' in link:
                findings.append(f"🚩 NON-HTTPS LINK: {link}")
    
    # 6. Urgency / fear tactics
    urgency_words = ['diblokir', 'ditutup', 'verifikasi', 'segara', '24 jam', 'peringatan']
    for word in urgency_words:
        if word.lower() in content.lower():
            findings.append(f"⚠️  Urgency tactic detected: '{word}'")
            break
    
    return findings

for fname in ['email-normal.eml', 'email-phishing.eml']:
    print(f"\n{'='*60}")
    print(f" ANALISIS: {fname}")
    print(f"{'='*60}")
    results = analyze_email(fname)
    for r in results:
        print(f" {r}")

print(f"\n{'='*60}")
print(" KESIMPULAN")
print(f"{'='*60}")
print("email-normal.eml:   ✅ Legitimate (SPF+DKIM+DMARC pass, domain konsisten)")
print("email-phishing.eml: 🚩 PHISHING (spoofed From, DKIM mismatch, link palsu, urgency)")
PYEOF

️ Analisis & Pertanyaan

1. Perbandingan Email Normal vs Phishing

Aspek Email Normal Email Phishing
Return-Path vs From Sama (company.com) Beda (attacker-mail.com vs bca.co.id)
IP Origin 192.168.1.100 (internal) 203.0.113.5 (hosting asing)
DKIM Domain company.com attacker-mail.com
SPF Pass ✅ Fail 🚩
Link bca.co.id sesuai phishing-bca-login.com (palsu)
Taktik Profesional Urgensi, ancaman blokir

2. 7 Ciri Email Phishing

# Ciri Contoh
1 Urgensi / ancaman "Akun akan ditutup!"
2 Link mencurigakan Domain berbeda dari yang terlihat
3 Salam generik "Kepada nasabah" (bukan nama Anda)
4 Typo / grammar error "Anda telah memenangkan hadiah"
5 Minta data sensitif Password, PIN, OTP, kartu kredit
6 Attachment aneh .docm, .exe, .zip tidak diminta
7 Alamat pengirim aneh [email protected] (tapi domain salah)

Laporan Temuan

Finding 1: Email Spoofing - Bank BCA (Critical)

Parameter Value
Tampilan From: [email protected]
Real Return-Path [email protected]
IP Origin 203.0.113.5 (attacker server)
SPF Fail (IP tidak terdaftar di SPF bca.co.id)
DKIM Mismatch (d=attacker-mail.com vs from=bca.co.id)
Link Palsu http://phishing-bca-login.com/verifikasi

Dampak: Nasabah yang klik link akan masuk ke halaman palsu dan kehilangan kredensial

Finding 2: Non-HTTPS Phishing Page (High)

Parameter Value
URL http://phishing-bca-login.com (HTTP, bukan HTTPS!)
Taktik Display teks bca.co.id tapi href ke domain palsu
Tech HTML anchor tag spoofing

Dampak: Kredensial dikirim dalam plaintext (HTTP)

Korelasi OWASP / CWE / CAPEC

Kerangka ID Deskripsi
CWE CWE-345 Insufficient Verification of Data Authenticity
CWE CWE-346 Origin Validation Error
CWE CWE-451 User Interface Misrepresentation
CWE CWE-522 Insufficiently Protected Credentials
CAPEC CAPEC-98 Phishing
CAPEC CAPEC-163 Email Header Analysis
CAPEC CAPEC-651 Email Spoofing

️ Remediasi

Ancaman Perlindungan Implementasi
Email spoofing SPF - izinkan IP tertentu Record TXT DNS
Email tampering DKIM - tanda tangan digital Generate key pair
Spoofing policy DMARC - kebijakan reject p=reject
Phishing link Link scanning + training Security awareness
User fall for phish MFA (lapis kedua) Google Authenticator, TOTP 
# Cek SPF record domain Anda sendiri
dig txt yourdomain.com | grep "v=spf1"

# Cek DMARC
dig txt _dmarc.yourdomain.com

# Setup DMARC reject (jika belum)
# Add TXT record: _dmarc.yourdomain.com
# Value: "v=DMARC1; p=reject; rua=mailto:[email protected]"

Kesimpulan & Refleksi

Apa yang dipelajari:

  • Header email mentah adalah sumber kebenaran - tidak bisa diubah oleh attacker
  • Return-Path mengungkap pengirim asli, bukan From yang terlihat
  • Received headers menunjukkan rute perjalanan email (baca dari bawah!)
  • SPF/DKIM/DMARC adalah senjata utama melawan spoofing
  • Link phishing sering menyembunyikan URL asli di balik teks

Refleksi untuk mahasiswa:

"Di dunia di mana 3.4 miliar email phishing dikirim setiap hari, kemampuan membaca header email adalah skill survival digital. Jangan percaya nama pengirim - percaya header. Dan jangan pernah klik link dari email yang meminta data pribadimu, bank tidak pernah minta password via email."

SELESAI! - Ringkasan 10 Lab Forensics Beginner

# Lab Skill Utama
1 🗂️ File Carving Memulihkan file terhapus
2 📅 Timeline Analysis MAC times & kronologi
3 🧠 Memory Forensics Volatility & RAM analysis
4 🌐 Network Forensics PCAP & traffic analysis
5 🔍 String & Metadata strings, exiftool, binwalk
6 🌐 Browser Forensics SQLite history & cookies
7 📋 Log Forensics auth.log, syslog, journalctl
8 🕵️ Steganography LSB, steghide, zsteg
9 🪟 Registry Forensics MRU, USB, persistence
10 📧 Email Forensics SPF/DKIM/DMARC, phishing

Referensi Lengkap

🔬 Semua 10 Lab Forensics Beginner Selesai!
Kembali ke Beranda Forensics

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy

← Sebelumnya Lab 9: Windows Registry Forensics - Menganalisis Registry untuk Menemukan Bukti Aktivitas Selanjutnya → Lab 11: Password Forensics - Menganalisis & Meretrieve Password dari Hash
PADA HALAMAN INI