↓ Skip to main content
Cameron Candau

25,587 SMTP

SMTP Enumeration (25, 587)
#

Run nmap SMTP scripts
#

nmap --script=smtp-* -p 25,587 $IP

Verify user with VRFY
#

echo "VRFY root" | nc -nv $IP 25

Expand alias with EXPN
#

echo "EXPN root" | nc -nv $IP 25

Check EHLO capabilities
#

printf 'EHLO test\r\nQUIT\r\n' | nc -nv $IP 25

Enumerate users with smtp-user-enum
#

smtp-user-enum -M VRFY -U /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -t $IP
smtp-user-enum -M EXPN -U /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -t $IP
smtp-user-enum -M RCPT -U /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -t $IP

Test STARTTLS on port 25
#

openssl s_client -starttls smtp -connect $IP:25

Test STARTTLS on port 587
#

openssl s_client -starttls smtp -connect $IP:587

Test SMTPS on port 465
#

openssl s_client -connect $IP:465

Brute force SMTP auth with hydra
#

hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 25 smtp://$IP