> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/smtp.md).

# SMTP

**SMTP** is primarily used for sending emails. Misconfigurations, such as open relays or enabled user enumeration features, can expose internal usernames or be abused for spam and phishing attacks.

***

### Default SMTP Ports

| Port | Description                     |
| ---- | ------------------------------- |
| 25   | Default SMTP (unencrypted)      |
| 465  | SMTP over SSL (SMTPS)           |
| 587  | SMTP with STARTTLS (submission) |

***

### Nmap NSE Scripts for SMTP

Use Nmap to gather information and test for vulnerabilities or misconfigurations:

```bash
nmap -p 25,465,587 --script=smtp-enum-users,smtp-commands,smtp-ntlm-info,smtp-open-relay <target>
```

| Script            | Purpose                                                      |
| ----------------- | ------------------------------------------------------------ |
| `smtp-enum-users` | Attempts to enumerate valid users via SMTP commands          |
| `smtp-commands`   | Lists supported SMTP commands                                |
| `smtp-ntlm-info`  | Attempts NTLM authentication and extracts domain information |
| `smtp-open-relay` | Checks if the server allows unauthorized mail relaying       |

***

### Manual SMTP Interaction with `telnet`

Connect manually to test server responses:

```bash
telnet <ip> 25
```

#### Common Commands

```
HELO test.com
VRFY username
EXPN username
MAIL FROM:<sender@example.com>
RCPT TO:<target@example.com>
AUTH LOGIN
```

Use these commands to check user existence or SMTP behavior.

***

### Tools for SMTP Enumeration

#### smtp-user-enum

A tool for enumerating users via SMTP commands like `VRFY`, `EXPN`, and `RCPT`.

| Example Usage                                                    | Description                                    |
| ---------------------------------------------------------------- | ---------------------------------------------- |
| `smtp-user-enum -M VRFY -U users.txt -t 10.0.0.1`                | Uses VRFY method against a single host         |
| `smtp-user-enum -M EXPN -u admin1 -t 10.0.0.1`                   | EXPN method for single user                    |
| `smtp-user-enum -M RCPT -U users.txt -T targets.txt`             | RCPT method against multiple hosts             |
| `smtp-user-enum -M EXPN -D example.com -U users.txt -t 10.0.0.1` | Uses EXPN with domain-specified user addresses |

> Wordlist: `/usr/share/metasploit-framework/data/wordlists/unix_users.txt`

```bash
finger user@<ip>
```