SMTP enumeration
Version fingerprinting and user enumeration on SMTP servers.
bash·1 min read··INE Certification
SMTP’s biggest enumeration win is usually username enumeration. The protocol’s own VRFY/EXPN commands (or timing/response differences around them) leak whether an account exists, which is exactly what smtp-user-enum and Metasploit’s smtp_enum module automate.
| Port | Use |
|---|---|
| 25 | Default SMTP |
| 465 / 587 | Common alternatives, usually authenticated/encrypted submission rather than open relay |
Banner and version
nmap -sV --script banner <target_ip> # grab the banner
telnet <target_ip> 25 # manual banner/interaction checkauxiliary/scanner/smtp/smtp_versionUser enumeration
auxiliary/scanner/smtp/smtp_enum # user enumerationsmtp-user-enum -U /usr/share/commix/src/txt/usernames.txt -t <target_ip>Sending mail
sendemail -f admin@attacker.xyz -t root@target.xyz -s <target_ip> -u "Fakemail" -m "test" -o tls=noSMTP is rarely interesting on its own, but it’s a reliable source of valid usernames. Anything enumerated here feeds directly into brute-forcing other services on the same host.
Related
- Hydra: brute-force other services with the usernames found
- Samba & SMTP Haraka exploitation: Haraka command injection
- Nmap: NSE scripts
- Netcat: manual banner grabbing
- Metasploit Framework: running the auxiliary modules