Skip to main content
Default Ports: 25 (SMTP), 465 (SMTPS), 587 (Submission) SMTP handles outbound mail delivery, and because it was designed in an era with no real concept of spoofing or abuse prevention, a lot of its original commands still double as enumeration and attack primitives today. User enumeration through VRFY, open relay abuse, and plaintext credential capture are all still findable on real engagements, especially on older or internally-facing mail servers.

Port 25

Server-to-server mail relay, the original SMTP port. Usually unauthenticated between trusted mail servers, which is exactly what makes open relay misconfigurations possible.

Ports 465 / 587

Client submission ports, used by mail clients to send outgoing mail. Normally require authentication and often enforce TLS.
mxtoolbox.com is worth checking early for passive recon: MX records, blacklist status, and SPF/DKIM configuration, all without touching the target directly.

​
SMTP Commands

Everything SMTP does, legitimately or for enumeration, happens through a small set of plaintext commands. Knowing these makes manual interaction over telnet or netcat straightforward instead of guesswork.
CommandDescription
HELO / EHLOOpens the session, identifying the client. EHLO also lists every extended command the server supports
MAIL FROMSpecifies the sender address
RCPT TOSpecifies the recipient address
DATABegins the actual message body
VRFYAsks the server to confirm whether a mailbox exists
EXPNAsks the server to expand a mailing list or alias into its member addresses
AUTH PLAINAuthenticates the client
RSETAborts the current message without closing the connection
NOOPNo-op, used to keep a connection alive
QUITCloses the session

​
Connecting Manually

A raw connection is often the fastest way to confirm what a server actually supports before reaching for a dedicated tool.
Once connected, EHLO is the first thing worth sending, it both opens the session properly and lists every extension the server supports in one response:

​
Nmap Enumeration

The open relay check specifically is worth running on its own, since a positive result is significant enough to call out separately:

​
User Enumeration

SMTP’s VRFY and EXPN commands were designed to confirm whether a mailbox exists, which makes them a direct username oracle on servers that haven’t disabled them. Where both are blocked, RCPT TO often still leaks the same information through a different response code.
Forcing a specific enumeration method matters when the default doesn’t work, some servers block VRFY but still respond differently to RCPT:
If smtp-user-enum isn’t available, the same check works manually over a raw connection: send VRFY username and compare the response code against a known-invalid username to spot the difference.

​
Open Relay Testing

Sending mail through a relay you don’t control, even for testing, can land you on a spam blacklist and generate real abuse reports. Confirm scope explicitly covers this before testing delivery.
An open relay forwards mail for domains it has no authority over, letting anyone send spoofed mail through the server’s own reputation. swaks is the most reliable way to test and craft messages manually.
For a more scripted phishing-style message with custom headers and body content:
sendemail is a lighter alternative when swaks isn’t installed:

​
Brute Forcing

Credential brute-forcing against SMTP itself works the same way, swap pop3 for smtp and point Hydra at port 25 or 587 depending on which service is actually enforcing authentication.

​
Metasploit Modules

​
Known RCE Vulnerability: Haraka

A positive version match against a known-vulnerable Haraka build is a critical finding, verify carefully and report before attempting exploitation.
The Haraka mail server had a well-documented remote code execution vulnerability in older versions, worth checking for once smtp_version has fingerprinted the server software.
Reference: exploit-db.com/exploits/47984

​
Quick Reference Tools

Hackviser: SMTP

Quick-reference pentesting guide for the SMTP service.

MXToolbox

Passive MX, blacklist, and mail configuration lookups.

SMTP Response Codes

Reference for interpreting SMTP status and error codes during manual testing.
User enumeration, relay testing, and credential brute-forcing all generate traffic that’s easy for a mail server to log and flag. Confirm scope before running anything beyond a passive version check.