> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # 25, 465 & 587 - SMTP (Simple Mail Transfer Protocol) `Default Ports: 25 (SMTP), 465 (SMTPS), 587 (Submission)` SMTP handles outbound mail delivery, and because it was designed in an era with no real concept of spoofing or abuse prevention, a lot of its original commands still double as enumeration and attack primitives today. User enumeration through `VRFY`, open relay abuse, and plaintext credential capture are all still findable on real engagements, especially on older or internally-facing mail servers. > **Port 25** > > Server-to-server mail relay, the original SMTP port. Usually unauthenticated between trusted mail servers, which is exactly what makes open relay misconfigurations possible. > **Ports 465 / 587** > > Client submission ports, used by mail clients to send outgoing mail. Normally require authentication and often enforce TLS. > [!TIP] > > [mxtoolbox.com](https://mxtoolbox.com/) is worth checking early for passive recon: MX records, blacklist status, and SPF/DKIM configuration, all without touching the target directly. *** ## SMTP Commands Everything SMTP does, legitimately or for enumeration, happens through a small set of plaintext commands. Knowing these makes manual interaction over telnet or netcat straightforward instead of guesswork.
Command Description
`HELO` / `EHLO` Opens the session, identifying the client. `EHLO` also lists every extended command the server supports
`MAIL FROM` Specifies the sender address
`RCPT TO` Specifies the recipient address
`DATA` Begins the actual message body
`VRFY` Asks the server to confirm whether a mailbox exists
`EXPN` Asks the server to expand a mailing list or alias into its member addresses
`AUTH PLAIN` Authenticates the client
`RSET` Aborts the current message without closing the connection
`NOOP` No-op, used to keep a connection alive
`QUIT` Closes the session
*** ## Connecting Manually A raw connection is often the fastest way to confirm what a server actually supports before reaching for a dedicated tool. ```bash theme={null} telnet TARGET 25 nc TARGET 25 ``` Once connected, `EHLO` is the first thing worth sending, it both opens the session properly and lists every extension the server supports in one response: ```text theme={null} EHLO test.local ``` *** ## Nmap Enumeration ```bash theme={null} sudo nmap TARGET -sC -sV -p25 sudo nmap TARGET -p25 --script smtp* -v ``` The open relay check specifically is worth running on its own, since a positive result is significant enough to call out separately: ```bash theme={null} sudo nmap TARGET -p25 --script smtp-open-relay -v ``` *** ## User Enumeration SMTP's `VRFY` and `EXPN` commands were designed to confirm whether a mailbox exists, which makes them a direct username oracle on servers that haven't disabled them. Where both are blocked, `RCPT TO` often still leaks the same information through a different response code. ```bash theme={null} smtp-user-enum -U users.txt -t TARGET -v ``` Forcing a specific enumeration method matters when the default doesn't work, some servers block `VRFY` but still respond differently to `RCPT`: ```bash theme={null} smtp-user-enum -M VRFY -U users.txt -t TARGET -D DOMAIN smtp-user-enum -M RCPT -U users.txt -t TARGET -D DOMAIN ``` > [!TIP] > > If `smtp-user-enum` isn't available, the same check works manually over a raw connection: send `VRFY username` and compare the response code against a known-invalid username to spot the difference. *** ## Open Relay Testing > [!WARNING] > > Sending mail through a relay you don't control, even for testing, can land you on a spam blacklist and generate real abuse reports. Confirm scope explicitly covers this before testing delivery. An open relay forwards mail for domains it has no authority over, letting anyone send spoofed mail through the server's own reputation. `swaks` is the most reliable way to test and craft messages manually. ```bash theme={null} swaks --from SENDER@EXAMPLE.COM --to RECIPIENT@TARGET.COM --server TARGET ``` For a more scripted phishing-style message with custom headers and body content: ```bash theme={null} swaks --from notifications@company.com --to employees@company.com --header 'Subject: Company Notification' --body 'Please complete the following survey: http://phishing-link.com/' --server TARGET ``` `sendemail` is a lighter alternative when `swaks` isn't installed: ```bash theme={null} sendemail -f admin@attacker.xyz -t root@target.xyz -s TARGET -u "Subject Line" -m "Message body" -o tls=no ``` *** ## Brute Forcing ```bash theme={null} hydra -L users.txt -p PASSWORD TARGET pop3 ``` > [!TIP] > > Credential brute-forcing against SMTP itself works the same way, swap `pop3` for `smtp` and point Hydra at port 25 or 587 depending on which service is actually enforcing authentication. *** ## Metasploit Modules ```bash theme={null} search name:smtp # list every SMTP-related module use auxiliary/scanner/smtp/smtp_version # fingerprint the mail server software and version use auxiliary/scanner/smtp/smtp_enum # enumerate valid users via VRFY ``` *** ## Known RCE Vulnerability: Haraka > [!WARNING] > > A positive version match against a known-vulnerable Haraka build is a critical finding, verify carefully and report before attempting exploitation. The Haraka mail server had a well-documented remote code execution vulnerability in older versions, worth checking for once `smtp_version` has fingerprinted the server software. ```bash theme={null} use exploit/linux/smtp/haraka ``` Reference: [exploit-db.com/exploits/47984](https://www.exploit-db.com/exploits/47984) *** ## Quick Reference Tools > **[Hackviser: SMTP](https://hackviser.com/tactics/pentesting/services/smtp)** > > Quick-reference pentesting guide for the SMTP service. > **[MXToolbox](https://mxtoolbox.com/)** > > Passive MX, blacklist, and mail configuration lookups. > **[SMTP Response Codes](https://serversmtp.com/smtp-error/)** > > Reference for interpreting SMTP status and error codes during manual testing. > [!WARNING] > > User enumeration, relay testing, and credential brute-forcing all generate traffic that's easy for a mail server to log and flag. Confirm scope before running anything beyond a passive version check. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.