smtp penetration testing skill by zebbern

SMTP Penetration Testing

Purpose

Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration. This skill covers banner grabbing, user enumeration techniques, relay testing, brute force attacks, and security hardening recommendations.

Prerequisites

Required Tools

# Nmap with SMTP scripts
sudo apt-get install nmap
 
# Netcat
sudo apt-get install netcat
 
# Hydra for brute force
sudo

Required Knowledge

SMTP protocol fundamentals
Email architecture (MTA, MDA, MUA)
DNS and MX records
Network protocols

Required Access

Target SMTP server IP/hostname
Written authorization for testing
Wordlists for enumeration and brute force

Outputs and Deliverables

SMTP Security Assessment Report - Comprehensive vulnerability findings
User Enumeration Results - Valid email addresses discovered
Relay Test Results - Open relay status and exploitation potential
Remediation Recommendations - Security hardening guidance

Core Workflow

Phase 1: SMTP Architecture Understanding

Phase 2: SMTP Service Discovery

Identify SMTP servers and versions:

Retrieve SMTP server information:

Parse banner information:

Phase 4: SMTP Command Enumeration

Test available SMTP commands:

Key commands to test:

Phase 5: User Enumeration

Enumerate valid email addresses:

Using Metasploit:

Using Nmap:

Phase 6: Open Relay Testing

Test for unauthorized email relay:

Using Metasploit:

Test variations:

Phase 7: Brute Force Authentication

Test for weak SMTP credentials:

Using Medusa:

Using Metasploit:

Phase 8: SMTP Command Injection

Test for command injection vulnerabilities:

Email spoofing test:

Phase 9: TLS/SSL Security Testing

Test encryption configuration:

Phase 10: SPF, DKIM, DMARC Analysis

Check email authentication records:

Quick Reference

Essential SMTP Commands

Command	Purpose	Example
HELO	Identify client	`HELO client.com`
EHLO	Extended HELO	`EHLO client.com`
MAIL FROM	Set sender	`MAIL FROM:<sender@test.com>`
RCPT TO	Set recipient	`RCPT TO:<user@target.com>`
DATA	Start message body	`DATA`
VRFY	Verify user	`VRFY admin`
EXPN	Expand alias	`EXPN staff`
QUIT	End session	`QUIT`

SMTP Response Codes

Code	Meaning
220	Service ready
221	Closing connection
250	OK / Requested action completed
354	Start mail input
421	Service not available
450	Mailbox unavailable
550	User unknown / Mailbox not found
553	Mailbox name not allowed

Enumeration Tool Commands

Tool	Command
smtp-user-enum	`smtp-user-enum -M VRFY -U users.txt -t IP`
Nmap	`nmap --script smtp-enum-users -p 25 IP`
Metasploit	`use auxiliary/scanner/smtp/smtp_enum`
Netcat	`nc IP 25` then manual commands

Common Vulnerabilities

Vulnerability	Risk	Test Method
Open Relay	High	Relay test with external recipient
User Enumeration	Medium	VRFY/EXPN/RCPT commands
Banner Disclosure	Low	Banner grabbing
Weak Auth	High	Brute force attack
No TLS	Medium	STARTTLS test
Missing SPF/DKIM	Medium	DNS record lookup

Constraints and Limitations

Legal Requirements

Only test SMTP servers you own or have authorization to test
Sending spam or malicious emails is illegal
Document all testing activities
Do not abuse discovered open relays

Technical Limitations

VRFY/EXPN often disabled on modern servers
Rate limiting may slow enumeration
Some servers respond identically for valid/invalid users
Greylisting may delay enumeration responses

Ethical Boundaries

Never send actual spam through discovered relays
Do not harvest email addresses for malicious use
Report open relays to server administrators
Use findings only for authorized security improvement

Examples

Example 1: Complete SMTP Assessment

Scenario: Full security assessment of mail server

Example 2: User Enumeration Attack

Scenario: Enumerate valid users for phishing preparation

Example 3: Open Relay Exploitation

Scenario: Test and document open relay vulnerability

Troubleshooting

Issue	Cause	Solution
Connection Refused	Port blocked or closed	Check port with nmap; ISP may block port 25; try 587/465; use VPN
VRFY/EXPN Disabled	Server hardened	Use RCPT TO method; analyze response time/code variations
Brute Force Blocked	Rate limiting/lockout	Slow down (`hydra -W 5`); use password spraying; check for fail2ban
SSL/TLS Errors	Wrong port or protocol	Use 465 for SSL, 25/587 for STARTTLS; verify EHLO response

Security Recommendations

For Administrators

Disable Open Relay - Require authentication for external delivery
Disable VRFY/EXPN - Prevent user enumeration
Enforce TLS - Require STARTTLS for all connections
Implement SPF/DKIM/DMARC - Prevent email spoofing
Rate Limiting - Prevent brute force attacks
Account Lockout - Lock accounts after failed attempts
Banner Hardening - Minimize server information disclosure
Log Monitoring - Alert on suspicious activity
Patch Management - Keep SMTP software updated
Access Controls - Restrict SMTP to authorized IPs