On this page 20 sections
  1. What SMTP is
  2. Common SMTP ports
  3. Initial enumeration
  4. SMTP banner
  5. HELO and EHLO
  6. Why EHLO matters
  7. VRFY
  8. EXPN
  9. SMTP user enumeration
  10. STARTTLS
  11. SMTP AUTH
  12. Basic SMTP mail flow
  13. Send a test message manually
  14. Open relay
  15. SMTP commands with Nmap
  16. Metasploit SMTP version scanner
  17. Metasploit SMTP user enumeration
  18. SMTP vs POP3 vs IMAP
  19. Enumeration workflow
  20. Quick reference
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

What SMTP is

SMTP, or Simple Mail Transfer Protocol, is used to send and relay email between mail clients and mail servers or between mail servers. SMTP is primarily a message-delivery protocol rather than a protocol for retrieving messages.

02

Common SMTP ports

TCP port 25 is traditionally used for mail transfer between servers. Port 587 is commonly used for authenticated message submission by clients. Port 465 is commonly associated with implicit TLS SMTP submission.

03

Initial enumeration

Start by identifying the SMTP service, implementation and available capabilities. The banner may reveal the mail server software, hostname or version information.

SMTP version detection
nmap -sV -p 25,465,587 <TARGET>
Default SMTP enumeration
nmap -sC -sV -p 25,465,587 <TARGET>
Manual connection
nc -nv <TARGET> 25
Connect with Telnet
telnet <TARGET> 25
04

SMTP banner

An SMTP server normally responds with a 220 banner when a connection is established. The response may reveal the server hostname and mail software.

Grab banner
nc -nv <TARGET> 25
05

HELO and EHLO

HELO identifies the SMTP client to the server. EHLO is the Extended SMTP version and usually causes the server to return a list of supported extensions and capabilities.

Basic greeting
HELO example.com
Extended greeting
EHLO example.com
06

Why EHLO matters

EHLO can reveal useful SMTP capabilities such as STARTTLS, AUTH methods, message-size limits and other supported extensions.

Enumerate capabilities manually
EHLO example.com
07

VRFY

VRFY asks the SMTP server to verify whether a mailbox or user exists. Some servers disable or restrict this command because it can expose valid usernames.

Verify user
VRFY <USERNAME>
08

EXPN

EXPN requests expansion of a mailing list or alias. If enabled, it may reveal users or addresses associated with a distribution list.

Expand alias or list
EXPN <LIST>
09

SMTP user enumeration

SMTP user enumeration may be possible through VRFY, EXPN or differences in server responses during SMTP transactions. Modern servers often restrict these techniques, so results should be validated carefully.

Nmap SMTP user enumeration
nmap -p 25 --script smtp-enum-users <TARGET>
10

STARTTLS

STARTTLS upgrades an existing plaintext SMTP connection to TLS. If the server advertises STARTTLS after EHLO, the client can request encryption before continuing the SMTP session.

Check STARTTLS capability
nmap -p 25 --script smtp-commands <TARGET>
Open TLS SMTP session
openssl s_client -starttls smtp -connect <TARGET>:25
11

SMTP AUTH

SMTP AUTH allows clients to authenticate before sending email. EHLO may reveal supported authentication mechanisms such as PLAIN or LOGIN.

Check SMTP capabilities
EHLO example.com
12

Basic SMTP mail flow

A manual SMTP transaction generally follows HELO or EHLO, MAIL FROM, RCPT TO, DATA and finally a single dot on its own line to finish the message body.

Sender
MAIL FROM:<sender@example.com>
Recipient
RCPT TO:<recipient@example.com>
Begin message
DATA
13

Send a test message manually

When authorised, SMTP can be tested manually to understand how the server handles sender and recipient addresses.

Example SMTP transaction
EHLO example.com
MAIL FROM:<test@example.com>
RCPT TO:<user@example.com>
DATA
Subject: Test

Test message
.
QUIT
14

Open relay

An open relay is an SMTP server that accepts mail from an unauthorised external sender and relays it to an external recipient. This is a mail-server misconfiguration and can be abused for spam or phishing.

Nmap relay test
nmap -p 25 --script smtp-open-relay <TARGET>
15

SMTP commands with Nmap

Nmap can enumerate commands advertised by the SMTP server and provide a quick overview of available capabilities.

Enumerate SMTP commands
nmap -p 25 --script smtp-commands <TARGET>
16

Metasploit SMTP version scanner

Metasploit provides auxiliary modules for SMTP service detection and user enumeration.

Start Metasploit
msfconsole
SMTP version scanner
use auxiliary/scanner/smtp/smtp_version
Set target
set RHOSTS <TARGET>
Run scanner
run
17

Metasploit SMTP user enumeration

The smtp_enum module can test potential usernames against supported SMTP enumeration behaviour.

Load SMTP enumeration
use auxiliary/scanner/smtp/smtp_enum
Set target
set RHOSTS <TARGET>
Show options
show options
Run enumeration
run
18

SMTP vs POP3 vs IMAP

SMTP is primarily used to send and relay messages. POP3 and IMAP are used to retrieve or access stored email. POP3 commonly uses ports 110 and 995, while IMAP commonly uses 143 and 993.

19

Enumeration workflow

Identify the SMTP ports and service version, inspect the banner, issue EHLO to enumerate capabilities, check STARTTLS and authentication support, test user-enumeration behaviour where authorised and determine whether the server improperly relays external mail.

Initial enumeration
nmap -sC -sV -p 25,465,587 <TARGET>
SMTP commands
nmap -p 25 --script smtp-commands <TARGET>
User enumeration
nmap -p 25 --script smtp-enum-users <TARGET>
20

Quick reference

These are the SMTP commands and tools worth remembering.

Version detection
nmap -sV -p 25,465,587 <TARGET>
Manual connection
nc -nv <TARGET> 25
Capabilities
EHLO example.com
Verify user
VRFY <USERNAME>
Expand list
EXPN <LIST>
STARTTLS
openssl s_client -starttls smtp -connect <TARGET>:25
Metasploit version
use auxiliary/scanner/smtp/smtp_version
Metasploit users
use auxiliary/scanner/smtp/smtp_enum