25,465,587 - Pentesting SMTP/s

Basic Information

SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download them periodically from the server.

In other words, users typically use a program that uses SMTP for sending e-mail and either POP3 or IMAP for receiving e-mail. On Unix-based systems, sendmail is the most widely-used SMTP server for e-mail. A commercial package, Sendmail, includes a POP3 server. Microsoft Exchange includes an SMTP server and can also be set up to include POP3 support. From here.

Default port: 25,465(ssl),587(ssl)

25/tcp open smtp syn-ack Microsoft ESMTP 6.0.3790.3959

EMAIL Headers

If you have the opportunity to make the victim send you a email (via contact form of the web page for example), do it because you could learn about the internal topology of the victim seeing the headers of the mail.

You can also get an email from a SMTP server trying to send to that server an email to a non-existent address (because the server will send to the attacker a NDN mail). But, be sure that you send the email from an allowed address (check the SPF policy) and that you can receive NDN messages.

You should also try to send different contents because you can find more interesting information on the headers like: X-Virus-Scanned: by You should send the EICAR test file. Detecting the AV may allow you to exploit known vulnerabilities.

Basic actions


nc -vn <IP> 25


openssl s_client -crlf -connect #SSL/TLS without starttls command
openssl s_client -starttls smtp -crlf -connect

Finding MX servers of an organisation

dig +short mx


nmap -p25 --script smtp-commands

NTLM Auth - Information disclosure

If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info here.

root@kali: telnet 587
220 SMTP Server Banner
250 Hello [x.x.x.x]
>> AUTH NTLM 334
NTLM supported

Or automate this with nmap plugin smtp-ntlm-info.nse


Check if you sniff some password from the packets to port 25

Username Bruteforce Enumeration

Authentication is not always needed


$ telnet 25
Connected to
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
250 myhost Hello [], pleased to meet you
250 2.1.0 Sender ok
RCPT TO:test
550 5.1.1 test... User unknown
RCPT TO:admin
550 5.1.1 admin... User unknown
250 2.1.5 ed... Recipient ok


$ telnet 25
Connected to
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
501 HELO requires domain address
250 myhost Hello [], pleased to meet you
VRFY root
250 Super-User <root@myhost>
VRFY blah
550 blah... User unknown


$ telnet 25
Connected to
Escape character is '^]'.
220 myhost ESMTP Sendmail 8.9.3
501 HELO requires domain address
EXPN test
550 5.1.1 test... User unknown
EXPN root
250 2.1.5 <ed.williams@myhost>
EXPN sshd
250 2.1.5 sshd privsep <sshd@mail2>

Extracted from:

Automatic tools

Metasploit: auxiliary/scanner/smtp/smtp_enum
nmap –script smtp-enum-users.nse <IP>

DSN Reports

Delivery Status Notification Reports: If you send an email to an organisation to an invalid address, the organisation will notify that the address was invalided sending a mail back to you. Headers of the returned email will contain possible sensitive information (like IP address of the mail services that interacted with the reports or anti-virus software info).


Send Email from linux console

root@kali:~# sendEmail -t -f -s -u Important Upgrade Instructions -a /tmp/BestComputers-UpgradeInstructions.pdf
Reading message body from STDIN because the '-m' option was not used.
If you are manually typing in a message:
- First line must be received within 60 seconds.
- End manual input with a CTRL-D on its own line.
IT Dept,
We are sending this important file to all our customers. It contains very important instructions for upgrading and securing your software. Please read and let us know if you have any problems.


Mail Spoofing

Most of this section was extracted from the book Network Security Assessment 3rd Edition.

SMTP messages are easily spoofed, and so organizations use SPF, DKIM, and DMARC features to prevent parties from sending unauthorised email.

A complete guide of these countermeasures can be found in


Sender Policy Framework (SPF) provides a mechanism that allows MTAs to check if a host sending an email is authorized. Then, the organisations can define a list of authorised mail servers and the MTAs can query for this lists to check if the email was spoofed or not. In order to define IP addresses/ranges, domains and others that are allowed to send email on behalf a domain name, different "Mechanism" cam appear in the SPF registry.





Matches always; used for a default result like -all for all IPs not matched by prior mechanisms.


If the domain name has an address record (A or AAAA) that can be resolved to the sender's address, it will match.


If the sender is in a given IPv4 address range, match.


If the sender is in a given IPv6 address range, match.


If the domain name has an MX record resolving to the sender's address, it will match (i.e. the mail comes from one of the domain's incoming mail servers).


If the domain name (PTR record) for the client's address is in the given domain and that domain name resolves to the client's address (forward-confirmed reverse DNS), match. This mechanism is discouraged and should be avoided, if possible.


If the given domain name resolves to any address, match (no matter the address it resolves to). This is rarely used. Along with the SPF macro language it offers more complex matches like DNSBL-queries.


References the policy of another domain. If that domain's policy passes, this mechanism passes. However, if the included policy fails, processing continues. To fully delegate to another domain's policy, the redirect extension must be used.


A redirect is a pointer to another domain name that hosts an SPF policy, it allows for multiple domains to share the same SPF policy. It is useful when working with a large amount of domains that share the same email infrastructure.

It SPF policy of the domain indicated in the redirect Mechanism will be used.

It's also possible to identify Qualifiers that indicates what should be done if a mechanism is matched. By default, the qualifier "+" is used (so if any mechanism is matched, that means it's allowed). You usually will note at the end of each SPF policy something like: ~all or -all. This is used to indicate that if the sender doesn't match any SPF policy, you should tag the email as untrusted (~) or reject (-) the email.


Each mechanism can be combined with one of four qualifiers:

  • + for a PASS result. This can be omitted; e.g., +mx is the same as mx.

  • ? for a NEUTRAL result interpreted like NONE (no policy).

  • ~ (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.

  • - (minus) for FAIL, the mail should be rejected (see below).

In the following example you can read the SPF policy of Note how the first SPF policy includes SPF policies of other domains:

kali@kali:~$ dig txt | grep spf 235 IN TXT "v=spf1 ~all"
kali@kali:~$ dig txt | grep spf
; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> txt
; IN TXT 235 IN TXT "v=spf1 ~all"
kali@kali:~$ dig txt | grep spf 1606 IN TXT "v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ~all"
kali@kali:~$ dig txt | grep spf 1908 IN TXT "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all"
kali@kali:~$ dig txt | grep spf 1903 IN TXT "v=spf1 ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ip4: ~all"

Traditionally it was possible to spoof any domain name that didn't have a correct/any SPF record. Nowadays, if email comes from a domain without a valid SPF record is probably going to be rejected/marked as untrusted automatically.

To check the SPF of a domain you can use online tools like:


DomainKeys Identified Mail (DKIM) is a mechanism by which outbound email is signed and validated by foreign MTAs upon retrieving a domain’s public key via DNS. The DKIM public key is held within a TXT record for a domain; however, you must know both the selector and domain name to retrieve it.

Then, to ask for the key you need the domain name and the selector of the mail from the mail header DKIM-Signature for example:;s=20120113

dig TXT | grep p= 280 IN TXT "k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCg


Domain-based Message Authentication, Reporting & Conformance (DMARC) is a method of mail authentication that expands upon SPF and DKIM. Policies instruct mail servers how to process email for a given domain and report upon actions performed.

To obtain the DMARC record, you need to query the subdomain _dmarc

root@kali:~# dig txt | grep DMARC 1785 IN TXT "v=DMARC1\; p=reject\; sp=none\; pct=100\;,\;"
root@kali:~# dig txt | grep DMARC 600 IN TXT "v=DMARC1\; p=quarantine\;"
root@kali:~# dig txt | grep DMARC 300 IN TXT "v=DMARC1\; p=reject\;\;,"

PayPal and Yahoo instruct mail servers to reject messages that contain invalid DKIM signatures or do not originate from their networks. Notifications are then sent to the respective email addresses within each organization. Google is configured in a similar way, although it instructs mail servers to quarantine messages and not outright reject them.

DMARC tags

Tag Name




Protocol version



Percentage of messages subjected to filtering



Reporting URI for forensic reports


Reporting URI of aggregate reports


Policy for organizational domain



Policy for subdomains of the OD



Alignment mode for DKIM



Alignment mode for SPF


What about Subdomains?

From here. You need to have separate SPF records for each subdomain you wish to send mail from. The following was originally posted on, which used to be a great resource for this kind of thing.

The Demon Question: What about subdomains?

If I get mail from, and there's no SPF data for pielovers, should I go back one level and test SPF for No. Each subdomain at Demon is a different customer, and each customer might have their own policy. It wouldn't make sense for Demon's policy to apply to all its customers by default; if Demon wants to do that, it can set up SPF records for each subdomain.

So the advice to SPF publishers is this: you should add an SPF record for each subdomain or hostname that has an A or MX record.

Sites with wildcard A or MX records should also have a wildcard SPF record, of the form: * IN TXT "v=spf1 -all"

This makes sense - a subdomain may very well be in a different geographical location and have a very different SPF definition.


You can attack some characteristics of mail clients to make the user think that the mail is coming from any address, more info:

More info

Find more information about these protections in

Exfiltration through SMTP

If you can send data via SMTP read this.

Config file