SMTP Enumeration

SMTP (Simple Mail Transfer Protocol) is a set of communication guidelines that allow web applications to perform communication tasks over the internet, including emails. It is a part of the TCP/IP protocol and works on moving emails across the network. SMTP enumeration allows us to identify valid users on the SMTP server. This is done with the built-in SMTP commands using them. VRFY – This command is used to authenticate the user. EXPN – This command displays the actual mailing address for aliases and mailing lists. RCPT TO – It identifies the recipient of the message. SMTP enumeration is a technique used to enumerate the SMTP service that is running on the target server.

Pre-Defined Commands:

• VRFY: It is used to validate the user on the server.
• EXPN: It is used to find the delivery address of mail aliases
• RCPT TO: It points to the recipient’s address.

Test for SMTP Enumeration:

SMTP enumeration can be performed by using different tools and scripts like telnet, Nmap, and smtp-user-enum.

1. Using Telnet for SMTP enumeration:

 Telnet comes in handy in SMTP enumeration as it provides a communication channel with the host. 

$ telnet <domain name/ip> <port no.> 

Example:

later you can use EXPN, MAIL FROM, and RCPT TO after connecting to the target host.

2. Using Nmap for SMTP enumeration:

 Nmap is a powerful tool and is used in different enumeration phases. Nmap provides special scripts for SMTP enumeration. smtp-enum-users is one of the scripts that is provided by Nmap.

 $sudo nmap -p 25 --script = 
 smtp-enum-users <target Domain/IP>

Example:

SMTP enumeration using Nmap

3. Using Metasploit for SMTP Enumeration:

Metasploit provides two SMTP auxiliary Modules i.e., smtp_enum and smtp_version. Both are used for SMTP enumeration and provide adequate information about the SMTP server. 

smtp_enum:

msf > use auxiliary/scanner/smtp/smtp_enum 
msf auxiliary(smtp_enum) set RHOSTS <IP address/target>
msf auxiliary(smtp_enum) > set rport 25
msf auxiliary(smtp_enum) set USER_FILE <address of file>
msf auxiliary(smtp_enum) run

Example:

smtp_version:

msf > use auxiliary/scanner/smtp/smtp_version
msf auxiliary(smtp_version) >
set RHOSTS <IP address of target>
msf auxiliary(smtp_version) > 
set threads 250
msf auxiliary(smtp_version) > 
run

Example: