How to crack the BCC recipients field on Gmail, YahooMail or hotmail?

Question

I am bachelor level student and have been given an assignment in my Network Security course. Is it possible to find out the recipients added in the BCC field? If yes, then how?

Answer 1

Very interesting assignment indeed!

Network security forum: https://security.stackexchange.com/

How to post a minimal, complete, and verifiable question in SL's term.

" Here are some tips to make sure your question qualifies:

- Post only programming-related QUESTIONS and ANSWERS;

- SEARCH for similar QUESTIONS or ANSWERS before posting;

- Include relevant TAGS;

- Follow community RULES: https://www.sololearn.com/Content-Creation-Guidelines/

DO NOT
- Post spam/advertisement;
- Use inappropriate language.

* Post general discussions and open-ended questions in your feed.
** In case of an assignment, providing a code snippet is mandatory."

Answer 2

Haider Javed Assuming the email client, the mail server, and network traffic haven't been compromised and everything is functioning as expected, then you won't be able to extract emails from the BCC.

BCC email addresses are removed from the message envelope by the mail server and shouldn't be included in the message headers by the email client.

Therefore, there would be no way of extracting addresses from the delivered emails.

Answer 3

BCC means to be hidden, cracking it is unethical act.

Answer 4

David is right. There is no information for anyone to do cracking here. Why should the mail server send and carry this hidden BCC information in the email, if it does not want to recipient to see it in the first place?

I really wondering this is a course assignment from your study.. 🤣

Answer 5

Haider Javed I surely believe you now.. 😁

Answer 6

Haider Javed If by application layer you mean the mail server, then sure, you can extract the BCC from the message envelope. However, this assumes you have access to the mail server as an admin and the mail service application code and configuration.

Answer 7

David Carroll so I cannot extract the addresses at the application layer?

Answer 8

Calviղ I assure you sir this is just a course assignment.

Answer 9

About email security you can read here https://powerdmarc.com/dmarc-business-case-banking/. If you still have any questions write to me a pm.