1ripMIME(1) MIME decoders ripMIME(1)
2
6 ripMIME - email attachment / decomposition tool.
7
9 ripMIME -i <mime file> -d <directory>
10 [-p prefix][-e [headerfile]]
11 [-v][-q][--verbose-contenttype][--verbose-oldstyle][--ver‐
12 bose-defects][--stdout][--stderr][--syslog]
13 [--paranoid]
14 [--name-by-type][--no-nameless][--overwrite][--no_nameless]
15 [--unique_names[--prefix|--postfix|--infix]][--mailbox]
16 [--no-tnef][--no-quotedprintable][--no-uudecode][--no-ole][--no-dou‐
17 blecr][--no-mht]
18 [--disable-qmail-bounce][--recursion-max <level>]
19 [--no-multiple-filenames]
20 [--exteded-errors][--debug][--version|-V][--buildcodes][-h]
21
23 ripMIME is a command line tool used to aid in the extraction of email
24 borne attachments to files which can be processed using other UNIX
25 tools. ripMIME supports both the RFC MIME standards as well as being
26 able to behave according to various MUA 'features' which are often used
27 as exploitation holes.
28
30 -i Input MIME encoded file (use '-' to input from STDIN)
31 -d Output directory
34 -p Specify prefix filename to be used on files without a filename
36 (default 'text')
37 -e [headers file name]
39 Dump headers from mailpack (default '_headers_')
40 -v Turn on verbosity
42 -q Run quietly, do not report non-fatal errors
44 --verbose-contenttype
47 Turn on verbosity of file content type
48 --verbose-oldstyle
50 Uses the v1.2.x style or filename reporting
51 --verbose-defects
53 Report MIME header/body defects located in the mailpack
54 --stdout
56 All reporting goes to stdout (Default)
57 --stderr
59 All reporting goes to stderr
60 --syslog
62 All reporting goes to syslog
63 --no-paranoid
65 [ Deprecated ] Turns off strict ascii-alnum filenaming
66 --paranoid
68 Converts all filenames to strict 7-bit compliance
69 --name-by-type
71 Saves a given attachment by its content-type if it has no other
72 name
73 --no-nameless
75 Do not save nameless attachments
76 --overwrite
78 Overwrite files if they have the same name on extraction
79 --unique-names
81 Dont overwrite existing files (This is the default behaviour)
82 --prefix
84 rename by putting unique code at the front of the filename
85 --postfix
87 rename by putting unique code at the end of the filename
88 --infix
90 rename by putting unique code in the middle of the filename
91 --recursion-max <maximum level>
93 Set the maximum recursion level into a mailpack. Often emails
94 are forwarded copies of an existing email, each time this is
95 done a new recursion level is required. Malicious emails can be
96 constructed with many hundereds of recursion levels to induce
97 stack faults in decoding programs. ripMIME is hard coded with a
98 default of 20 levels, this may be overidden using this parame‐
99 ter.
100 --mailbox
102 Process mailbox file
103 --extended-errors
105 Returns error codes for non-fatal decoding situations
106 --debug
108 Produces detailed information about the whole decoding process
109 Attachment type decoding switches
112 --no-tnef
113 Turn off TNEF/winmail.dat decoding
114 --no-ole
116 Turn off OLE decoding
117 --no-uudecode
119 Turns off the facility of detecting UUencoded attachments in
120 emails
121 --no-quotedprintable
123 Turns off the facility of decoding QuotedPrintable data
124 --no-doublecr
126 Turns off saving of double-CR embedded data
127 --no-mht
129 Turns off MHT (a Microsoft mailpack attachment format ) decoding
130 --disable-qmailbounce
132 Turns off ripMIME's look-ahead searching for RFC822 headers
133 within a body of text. Normally the look-ahead is useful for
134 decoding embedded emails which have been bounced back by systems
135 like qmail, but have been included in such a way that they are
136 not meant to be decoded, unfortunately some MUA (Outlook for
137 one) still decode it, hence we need to by default check for
138 attachments in such forwarded bodies.
139 --no-multiple-filenames
141 Turns off the behaviour of handling multiple filename occurances
142 in a single MIME header. Normally ripMIME will generate a hard
143 link for each additional filename beyond the original attachment
144 filename detected.
145 Auxillary parameters
148 --buildcodes
149 Displays the information obtained by the Makefile script when
150 ripMIME was built. This includes the Unix timestamp, human
151 readable version of the timestamp and the output from 'uname
152 -a'.
153 -V --version
155 Give version information
156 -h Terse information on how to use ripMIME.
158
160 None
161
163 None
164
166 To unpack an email in a file 'mailpack' to the directory /tmp with ver‐
167 bose output of the files unpacked;
168 ripmime -i mailpack -v -d /tmp
170
172 Paul L Daniels
173 ripMIME WWW site http://www.pldaniels.com/ripmime
174 ripMIME mailing list <ripmime-general@pldaniels.com>
175 For mailpacks which do not appear to decode correctly - please email to
176 <mailpacks-2004@pldaniels.com>
177
179 altermime(1), inflex(1), ripole(1), opentnef(1)
180Paul L Daniels 1.4.0.1 ripMIME(1)