Parse E-mails into a JSON blob that can easily be analyzed.
All the information in a header, body and attachment are put into a JSON blob, making it easier for Incident Responders to analyze the content of an E-mail.
These features could be helpfull to do a quick analysis on the E-mail.
- Extract URLS from body.
- Extract Sender-IP out of headers.
- Extract Attachments out of E-Mail.
Install packages mentioned in the requirements.txt
pip3 install -r requirements.txtusage: Python Email Parser [-h] [-v] [-d DIR] [-a] [-o] [-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}]
Parse emails to JSON format.
options:
-h, --help show this help message and exit
-v, --version show program's version number and exit
-d DIR, --dir DIR Path to directory with emails.
-a, --attachments Extract attachments out of emails. Saves into attachment directory.
-o, --output Name of the output JSON file.
-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}, --loglevel {DEBUG,INFO,WARNING,ERROR,CRITICAL}
Set the log level for debugging purposes. Choices: DEBUG, INFO, WARNING, ERROR, CRITICAL
Example: python3 main.py -d /home/user/emails/ -a
The resources directory contains the output of the program, logs and extracted attachments.
attachmentscontains extracted attachementslogscontains logs of the mail-parseroutcontains the JSON files
{
"256Hash of mail": {
"HASH": {
"Headers": {
"Return-Path": "<RETURN-PATH>",
"X-Original-To": "EMAIL",
"Delivered-To": "EMAIL",
"From": "NAME <EMAIL>",
"To": "EMAIL",
"Subject": "SUBJECT",
"Date": "09 Dec 2019 04:41:12 0200",
"Message-ID": "<MESSAGE_ID>",
"MIME-Version": "1.0",
"Content-Type": "text/html;\n\tcharset=\"iso-8859-1\"",
"Content-Transfer-Encoding": "quoted-printable",
"Received": [
{
"from": "MAIL_SERVER unknown SENDER_IP",
"by": "RECEIVER_MAILSERVER Postfix",
"with": "ESMTP",
"id": "EMAIL_ID",
"for": "<EMAIL>",
"date": "Tue, 09 Dec 2019 04:41:12 0200 CEST",
"hop": 1,
"date_utc": "2019-12-09T02:41:12",
"delay": 0
}
],
"SenderIP": [
"EXTRACTED_IP"
]
},
"Attachments": [],
"Body": {
"Content": "BODY_STRIPPED_FROM_HTML_TAGS",
"Links": [
"LINK_0",
"LINK_1"
]
}
}
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.