25 465 587 - SMTP

Login

Basic

nc -nv <ip> 25

Secure

openssl s_client -crlf -connect <ip>:465

Secure with STARTTLS

openssl s_client -starttls smtp -crlf -connect <ip>:587

Commands

HELO <domain>
MAIL FROM <sender email>
RCPT TO <dest email>
DATA
RSET
VRFY <email>
NOOP
QUIT

Extended SMTP

EHLO
AUTH <method> <user and pass>
STARTTLS
SIZE
HELP

Send an email

HELO x
MAIL FROM <sender address>
RCPT TO <dest address>
DATA
<mail body>
.

Enumeration

nmap <ip> -p <port> -sV --script smtp-* -vv

User bruteforce

Manual

HELO x
<EXPN or VRFY> <username>

The RCPT TO command requires to specify an email to use as source. Sometimes when providing an incomplete destination address the mail server will autocomplete the email revealing the internal name.

HELO x
MAIL FROM [e-mail]
RCPT TO <username>

Automatic tools

Use to following script to generate possible variants of a given username. Downloadable from here

python usernamer.py -n '<user>'

Verify the existence of the generated usernames.

smtp-user-enum -M VRFY -D <mail domain> -u <user> -t <ip>
smtp-user-enum -M VRFY -D <mail domain> -U <file>.txt -t <ip>