> For the complete documentation index, see [llms.txt](https://ymiir.gitbook.io/extra/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ymiir.gitbook.io/extra/ctf-cheat/email-analysis-ctf.md).

# Email Analysis CTF

On 10:hats internal CTF, I create a challenge that require participant to analyze some email that attachment. 

## Sample 

<figure><img src="/files/BMrwvousdDIy6MYIAYbZ" alt=""><figcaption></figcaption></figure>

This email I take as sample for challenge. In this eml, it contains more than one electronic mail messages. That means, open up using any Email (thunderbird, gmail and etc), we can only read top first part only. For the rest, it not display some of other part contains attachment.&#x20;

1. Understanding How electronic mail messages Work

* Need to have some beginner skill to read email.&#x20;
* What is important part in email.
* What is DNS, DKIM, hosting etc.

1. Find attachment

<figure><img src="/files/Hh7yvmxCtifPYJDkEbWV" alt=""><figcaption></figcaption></figure>

* Looking into content-type (same as in Burp)
* Get some info about file name and encoding type.

1. Using base64 guru

<figure><img src="/files/Fe46Cq3Lz9LfPRYqCoNp" alt=""><figcaption></figcaption></figure>

pst : something you need to understand how it work and manually do instead using tools given. :D