9.2.3 Identify mail-service identities and supported interactions SMTP Enumeration

← Stage index · Cheatsheet | Strategy map | Study methods: Extract opportunities from services

Recognize: SMTP commonly uses TCP/25, submission uses 587, and implicit TLS commonly uses 465. Goal: collect banner/capabilities, mail-domain clues and only defensible user evidence.

nc -nv TARGET PORT

Then enter:

EHLO example.invalid
HELP
VRFY USER
EXPN postmaster
QUIT

Decisive output: 250- capability lines reveal extensions such as STARTTLS or AUTH. 250 after VRFY may support a valid mailbox; 550 commonly rejects or denies it; 252 explicitly means the server will not verify and is not proof that the user exists.

9.2.3.1.1 Variant — STARTTLS or implicit TLS

openssl s_client -connect TARGET:587 -starttls smtp -crlf -quiet
openssl s_client -connect TARGET:465 -crlf -quiet

Run EHLO example.invalid after TLS negotiation. Certificate names and capabilities can yield host/domain clues; authentication still requires a supported identity and mechanism.

9.2.3.1.2 Variant — focused automated user checks

smtp-user-enum -M VRFY -U users.txt -t TARGET -p PORT
smtp-user-enum -M RCPT -U users.txt -t TARGET -p PORT

RCPT testing requires an SMTP transaction and servers may deliberately normalize responses. Treat automation as candidate generation and manually compare decisive responses.

9.2.3.1.3 Variant — Windows source position

Test-NetConnection -ComputerName TARGET -Port PORT

This verifies TCP reachability only. Use an available Netcat/Ncat or OpenSSL client for protocol dialogue.

Failure cues: multiline replies begin with NNN- and finish with NNN ; read the final line. 503 often means the command sequence is wrong. Uniform 252 or 550 responses make enumeration inconclusive. A visible AUTH method does not mean anonymous relay or valid credentials.

Next action: add confirmed/candidate names and domains to the private evidence ledger; test new names only in the later credential block. Do not send real mail or run relay checks unless the objective requires it.

9.2.3.2 POP3 and IMAP handoff

Mail-access services expose mailbox capabilities and, with legitimate credentials, stored messages that may contain workflow or reset links.

openssl s_client -connect TARGET:995 -crlf -quiet   # POP3S
openssl s_client -connect TARGET:993 -crlf -quiet   # IMAPS

POP3 dialogue:

CAPA
USER USER
PASS PASSWORD
STAT
LIST
QUIT

IMAP dialogue:

a1 CAPABILITY
a2 LOGIN USER PASSWORD
a3 LIST "" "*"
a4 LOGOUT

Test one legitimately acquired credential. Capability output is not authentication; avoid brute-force NSE scripts until lockout/authorization is explicitly understood. Source supplement: reviewed getSH Nmap mail blocks.

9.2.3 Identify mail-service identities and supported interactions SMTP Enumeration

9.2.3.1 Baseline: banner and capabilities

9.2.3.2 POP3 and IMAP handoff