keraattin / emailanalyzer

With EmailAnalyzer you can analyze your suspicious emails. You can extract headers, links, and hashes from the .eml file and you can generate reports.

👨‍💻 About Me

• 😄 Pronouns: He/Him
• 🔭 Interests: Cyber Security, Software Security, Threat Hunting, SOC Engineering, QA and Software Engineering
• 💼 Experience: 4 Years in Information&Cyber Security

🛠️ My Skillset

Programming

Database

Frontend

🧪 QA & Testing

🎛️ Operating System

🗄️ DevOps & System

📊 Stats

emailanalyzer's Issues

CLI execution with redirection to a file not working as expected

Description:

When attempting to redirect the output of the email-analyzer.py script to a file, such as "python3 email-analyzer.py file.eml > email.log", an error is encountered. The error message reads:

Traceback (most recent call last):
  File "C:\Users\Yoanndp\Desktop\EmailAnalyzer\email-analyzer.py", line 201, in <module>
    description = str(get_introduction_banner())+"_"*TER_COL_SIZE
  File "C:\Users\Yoanndp\Desktop\EmailAnalyzer\banners.py", line 6, in get_introduction_banner
    print("""
  File "C:\Users\Yoanndp\AppData\Local\Programs\Python\Python310\lib\encodings\cp1252.py", line 19, in encode
    return codecs.charmap_encode(input,self.errors,encoding_table)[0]
UnicodeEncodeError: 'charmap' codec can't encode characters in position 14-25: character maps to <undefined>.

Expected Behavior:

When executing the command "python3 email-analyzer.py file.eml > email.log", the output of the email-analyzer.py script should be redirected to the specified file "email.log" without any error.

Observed Behavior:

When executing the command "python3 email-analyzer.py file.eml > email.log", the output is not redirected to the specified file, and the following error is encountered:

UnicodeEncodeError: 'charmap' codec can't encode characters in position 14-25: character maps to <undefined>.

Steps to Reproduce:

1. Open a terminal or command prompt
2. Navigate to the directory containing the email-analyzer.py script and an email file (file.eml)
3. Execute the command "python3 email-analyzer.py file.eml > email.log"
4. Observe the error message displayed in the terminal.

Environment:

• Operating System: Windows 10 21H2
• Python Version: 3.10.11

Html Report - String to Tag issue

Bug Description
Html report don't show some headers values in the report.
The browser recognizes some headers as a tag. It doesn't show the content because of that.

Expected Behavior or Results
The browser should show the values correctly.

Reproduce Steps
Steps to reproduce the behavior:

1. Run EmailAnalzer and create report with using eml file that provided.
   python email-analyzer.py -f test.eml -o out.html
2. Open the out.html
3. Check the return-path value

Desktop (please complete the following information):

• OS with Version : Windows 10
• Browser with Version : Google Chrome | 114.0.5735.110 (Official Build) (64-bit)
• EmailAnalyzer Project Version : 2.0 ( Development Branch )

Screenshots or Attachments (If Applicable)

test.eml file can be found from : https://www.phpclasses.org/browse/file/14672.html
or you can convert this txt file to eml file.
test.txt

Received Header Issue

Bug Description
Program doesn't show the all of the Received headers. Printing and generating report has same issue.

Expected Behavior or Results
Some eml files have more than 1 Received headers. We expect the EmailAnalyzer show all of the Received headers.

Reproduce Steps
Steps to reproduce the behavior:

1. Find an eml file that have more than 1 Received headers.
2. Run the EmailAnalyzer
   python email-analyzer.py -f mail.eml -Hi
3. Check the Header section in the result.

Desktop (please complete the following information):

• OS with Version : Doesn't matter
• Browser with Version : Doesn't matter
• EmailAnalyzer Project Version : v2.0 ( Development Branch)

traceback error

hello, i got some trace back error when analyzing the header from outlook.

Traceback (most recent call last):
File "/home/dexter/tools/email-header-analyzer/mha/server.py", line 65, in dateParser
r = dateutil.parser.parse(line, fuzzy=True)
File "/home/dexter/.local/lib/python3.10/site-packages/dateutil/parser/_parser.py", line 1368, in parse
return DEFAULTPARSER.parse(timestr, **kwargs)
File "/home/dexter/.local/lib/python3.10/site-packages/dateutil/parser/_parser.py", line 643, in parse
raise ParserError("Unknown string format: %s", timestr)
dateutil.parser._parser.ParserError: Unknown string format: from JH0PR02MB6921.apcprd02.prod.outlook.com (2603:1096:990:53::14)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/dexter/.local/lib/python3.10/site-packages/flask/app.py", line 1478, in call
return self.wsgi_app(environ, start_response)
File "/home/dexter/.local/lib/python3.10/site-packages/flask/app.py", line 1458, in wsgi_app
response = self.handle_exception(e)
File "/home/dexter/.local/lib/python3.10/site-packages/flask/app.py", line 1455, in wsgi_app
response = self.full_dispatch_request()
File "/home/dexter/.local/lib/python3.10/site-packages/flask/app.py", line 869, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/home/dexter/.local/lib/python3.10/site-packages/flask/app.py", line 867, in full_dispatch_request
rv = self.dispatch_request()
File "/home/dexter/.local/lib/python3.10/site-packages/flask/app.py", line 852, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
File "/home/dexter/tools/email-header-analyzer/mha/server.py", line 115, in index
org_time = dateParser(line[-1])
File "/home/dexter/tools/email-header-analyzer/mha/server.py", line 72, in dateParser
r = dateutil.parser.parse(r[0])
File "/home/dexter/.local/lib/python3.10/site-packages/dateutil/parser/_parser.py", line 1368, in parse
return DEFAULTPARSER.parse(timestr, **kwargs)
File "/home/dexter/.local/lib/python3.10/site-packages/dateutil/parser/_parser.py", line 643, in parse
raise ParserError("Unknown string format: %s", timestr)

Python Spefications

Hello, thanks for your project, it looks very helpful..

I have a issue with it,

What are the things that have to be installed prior to try to execute it ??

I tried with some versions of Python and it did not work

Thanks