25, 465, 587 - Pentesting SMTP

SMTP enumeration, user enumeration techniques, email spoofing, SPF/DKIM/DMARC analysis, open relay testing, SMTP smuggling, and phishing infrastructure assessment.

The Simple Mail Transfer Protocol (SMTP) is used for sending and receiving email. It is commonly paired with POP3 or IMAP for message retrieval.

Default Ports: 25 (SMTP), 465 (SMTPS), 587 (SMTP with STARTTLS)

Basic Connections

# SMTP (plain)
nc -vn <IP> 25

# SMTPS (TLS)
openssl s_client -crlf -connect smtp.mailgun.org:465

# SMTP with STARTTLS
openssl s_client -starttls smtp -crlf -connect smtp.mailgun.org:587

Enumeration

# Nmap
nmap -p25 --script smtp-commands 10.10.10.10
nmap -p25 --script smtp-open-relay 10.10.10.10 -v
nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720 -p 25 <IP>

# Find MX servers
dig +short mx google.com

NTLM Info Disclosure

If the server supports NTLM auth (Windows), send a challenge to extract version info:

telnet example.com 587
>> HELO
>> AUTH NTLM 334
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
# Response contains: IIS version, Windows version

# Automate with nmap
nmap -p25 --script smtp-ntlm-info.nse <IP>

Username Enumeration

VRFY

telnet 1.1.1.1 25
HELO x
VRFY root
# 250 Super-User root@myhost = exists
VRFY blah
# 550 blah... User unknown

RCPT TO

telnet 1.1.1.1 25
HELO x
MAIL FROM:[e-mail]
RCPT TO:test
# 550 = unknown, 250 = exists

EXPN

EXPN root
# 250 2.1.5 ed.williams@myhost
EXPN sshd
# 250 2.1.5 sshd privsep sshd@myhost

Tools

smtp-user-enum -M VRFY -U users.txt -t <IP>
smtp-user-enum -M EXPN -U users.txt -t <IP>
smtp-user-enum -M RCPT -U users.txt -t <IP>

msf> use auxiliary/scanner/smtp/smtp_enum

Sending Emails

# sendEmail
sendEmail -t [e-mail] -f [e-mail] -s <smtp_ip> \
  -u "Important subject" -a /tmp/payload.pdf

# swaks
swaks --to [e-mail] \
  --from [e-mail] \
  --header "Subject: Test" \
  --body "Click http://attacker/" \
  --server <SMTP_IP>

# With attachment (use @ prefix to embed file bytes)
swaks --to [e-mail] --from [e-mail] \
  --header "Subject: Resume" \
  --body "Please review" \
  --attach @resume.doc \
  --server 10.0.0.5

Email Security Mechanisms

SPF (Sender Policy Framework)

# Check SPF record
dig txt google.com | grep spf

# Online validator
# https://www.kitterman.com/spf/validate.html

SPF Qualifiers:

• + = PASS (default)
• ? = NEUTRAL
• ~ = SOFTFAIL (accept but mark)
• - = FAIL (reject)

DKIM (DomainKeys Identified Mail)

# Get DKIM public key (need selector from email headers)
dig 20120113._domainkey.gmail.com TXT | grep p=

DMARC

# Get DMARC record
dig _dmarc.facebook.com txt | grep DMARC
# p=reject: strict rejection
# p=quarantine: mark as spam
# p=none: monitoring only

Avoiding Email Security Gateways (SEGs)

Organizations using Entra ID / Exchange Online often have multiple accepted domains. If any accepted domain has an MX record pointing directly to the mail server (bypassing the SEG), you can deliver mail avoiding the gateway.

The default <tenant>.onmicrosoft.com domain always has MX pointing to Exchange Online.

# Enumerate accepted domains
dnsx -d target.com -mx

# Send to tenant.onmicrosoft.com to bypass SEG
# swaks --to [e-mail] ...

SMTP Spoofing

# Check for spoofing vulnerabilities
python3 -m serain.mailspoof target.com
python3 checkdmarc.py target.com

# Automated spoofing
python3 magicspoofmail.py -d victim.com -t -e [e-mail]
python3 magicspoofmail.py -d victim.com -t -e [e-mail] \
  --subject TEST --sender [e-mail]

Open Relay Testing

nmap -p25 --script smtp-open-relay 10.10.10.10 -v

Open relay configuration (misconfiguration to look for):

mynetworks = 0.0.0.0/0  # Accepts connections from any IP

SMTP Smuggling

SMTP smuggling allows bypassing SPF, DKIM, and DMARC protections by exploiting line ending interpretation differences between SMTP servers. Some servers accept <LF>.<LF> while others only accept <CR><LF>.<CR><LF>, enabling message injection.

Config Files

/etc/postfix/master.cf
/etc/postfix/main.cf
sendmail.cf
submit.cf

Post-Exploitation: Headers Reveal Internal Structure

If you can make the victim send you an email (e.g., contact form), inspect the headers:

• Internal server names and IP addresses
• Antivirus software info (X-Virus-Scanned header)
• Internal relay hops

NDN (Non-Delivery Notification) Harvesting

Send emails to non-existent addresses. The bounce-back NDN often contains:

• Internal server names
• IP addresses of mail infrastructure
• AV software information