SMTP Penetration Testing – Complete Free Guide

Work in progress

SMTP Introduction

MUA → MSA → MTA → internet → MTA → MDA → MUA

Outlook → Exchange → firewall → internet → SMTP-Server of the receiving side → mail-server of the receiving side → Outlook of receiver

SMTP Commands

SMTP Penetration Testing

SMTP Tools

Nmap

nmap --script smtp-brute -p 25,465,587 <target-ip>
nmap --script smtp-commands -p 25,465,587 <target-ip>
nmap --script smtp-enum-users -p 25,465,587 <target-ip>
nmap --script smtp-ntlm-info --script-args smtp-ntlm-info.domain=example.com -p 25,465,587 <target-ip>
nmap --script smtp-vuln-cve2011-1764 -p 25,465,587 <target-ip>
nmap --script smtp-* -p 25,465,587 <target-ip>

Metasploit

SWAKS

swaks --to remote-user@example.com --from local-user@<local-ip> --server mail.example.com --body "hello"

sendEmail -t dept@victim.com -f support@rfs.com -s 192.168.8.131 -u Important Upgrade Instructions -a /tmp/BestComputers-UpgradeInstructions.pdf

SMTP Scanning

nmap –script smtp-enum-users.nse 172.180.22.16

nmap -p25 --script smtp-open-relay 172.180.22.16 -v

nmap -p25 --script smtp-commands 172.180.22.16

SMTP Enumeration

Banner Grabbing

nc -vn 172.180.22.16 25

auxiliary/scanner/smtp/smtp_enum

SMTP Exploitation

SMTP Post Exploitation

sudo python -m smtpd -n -c DebuggingServer :25

SSH Penetration Testing

FTP penetration testing

RDP Penetration Testing

SMB Penetration Testing

PostgreSQL Penetration Testing