# 25 465 587 - SMTP

## Login

Basic

```
nc -nv <ip> 25
```

Secure

```
openssl s_client -crlf -connect <ip>:465
```

Secure with STARTTLS

```
openssl s_client -starttls smtp -crlf -connect <ip>:587
```

## Commands

```
HELO <domain>
MAIL FROM <sender email>
RCPT TO <dest email>
DATA
RSET
VRFY <email>
NOOP
QUIT
```

Extended SMTP

```
EHLO
AUTH <method> <user and pass>
STARTTLS
SIZE
HELP
```

### Send an email

```
HELO x
MAIL FROM <sender address>
RCPT TO <dest address>
DATA
<mail body>
.
```

## Enumeration

```
nmap <ip> -p <port> -sV --script smtp-* -vv
```

### User bruteforce

#### Manual

```
HELO x
<EXPN or VRFY> <username>
```

The RCPT TO command requires to specify an email to use as source. Sometimes when providing an incomplete destination address the mail server will autocomplete the email revealing the internal name.

```
HELO x
MAIL FROM test@mail.com
RCPT TO <username>
```

#### Automatic tools

Use to following script to generate possible variants of a given username. Downloadable from [here](https://raw.githubusercontent.com/jseidl/usernamer/master/usernamer.py)

```
python usernamer.py -n '<user>'
```

Verify the existence of the generated usernames.

```
smtp-user-enum -M VRFY -D <mail domain> -u <user> -t <ip>
smtp-user-enum -M VRFY -D <mail domain> -U <file>.txt -t <ip>
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://security-notes.gitbook.io/security-notes/networking/ports/25-465-587-smtp.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.