An HTML attachment that builds a ZIP
Extract a base64 HTML attachment from a raw message, decode it, and see how it assembles a ZIP in the browser so the mail gateway never sees the archive.
Briefing
Mail gateways scan attached archives and executables. HTML smuggling sends a harmless-looking HTML file instead; when opened, its script builds the payload in the browser and triggers a download.
Attachments in raw messages are MIME parts, usually base64 encoded. You can cut the part out with grep and decode it with base64 -d.
mail-triage · Email and phishing
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.