#!/bin/bash
# -------------------------------------------------------------
#  SCENARIO B - Classic spoof  (expected: DMARC FAIL --> REJECT)
# -------------------------------------------------------------
#
#  Flow:  swaks --> direct to receiver-mta (bypassing sender-mta)
#         No DKIM signing, spoofed From header
#
#  MAIL FROM: <random@evil.lab>
#  From:      CEO <ceo@legit.lab>   -- impersonation!
#  To:        bob@receiver.lab
#  DKIM:      none (no signature)
#
#  Expected results on receiver-mta:
#    SPF  = none   (evil.lab has no SPF record)
#    DKIM = none   (no signature present)
#    DMARC= fail   (From=legit.lab, no aligned SPF/DKIM)
#    Action: 550 REJECT (legit.lab policy is p=reject)
# -------------------------------------------------------------

set -e

echo ""
echo "---------------------------------------------------"
echo "  SCENARIO B - Classic Spoof (DMARC --> REJECT)    "
echo "---------------------------------------------------"
echo ""

# Send directly to receiver-mta, bypassing sender-mta's DKIM signing
swaks \
    --to bob@receiver.lab \
    --from random@evil.lab \
    --h-From "CEO <ceo@legit.lab>" \
    --h-Subject "URGENT: Wire transfer needed immediately" \
    --body "This is a spoofed email. I am the CEO.\nThe From header says legit.lab but the envelope says evil.lab.\nNo DKIM signature is present." \
    --server 10.0.0.20 \
    --port 25 \
    --timeout 30 \
    || true   # swaks will exit non-zero on SMTP reject - that's expected

echo ""
echo " -- Scenario B sent. Check receiver-mta logs for REJECT. --"
echo " -- Expected: spf=none/fail, dkim=none, dmarc=fail --> 550 reject --"
echo ""
