O/ OSCP exploitation reference
Workspace controls Memory only · 0 steps
Visualize path ↗
Command values 0 filled

Temporary connection values clear on reload. Passwords, hashes and tickets remain placeholders. Check address-family syntax in the selected command.

← All services tasks

Enumerate SMTP identities and accessible mailbox protocols

Needs: Reachable SMTP/POP3/IMAP service; enumeration or mailbox access must be enabled for the selected context

Recognize: SMTP commonly uses TCP/25, submission uses 587, and implicit TLS commonly uses 465. Goal: collect banner/capabilities, mail-domain clues and only defensible user evidence.

# Baseline: banner and capabilities
nc -nv TARGET PORT

Then enter

# Then enter
EHLO example.invalid
HELP
VRFY USER
EXPN postmaster
QUIT

Decisive output: 250- capability lines reveal extensions such as STARTTLS or AUTH. 250 after VRFY may support a valid mailbox; 550 commonly rejects or denies it; 252 explicitly means the server will not verify and is not proof that the user exists.

STARTTLS or implicit TLS

# Variant — STARTTLS or implicit TLS
openssl s_client -connect TARGET:587 -starttls smtp -crlf -quiet
openssl s_client -connect TARGET:465 -crlf -quiet

# Variant — focused automated user checks
smtp-user-enum -M VRFY -U users.txt -t TARGET -p PORT
smtp-user-enum -M RCPT -U users.txt -t TARGET -p PORT

Run EHLO example.invalid after TLS negotiation. Certificate names and capabilities can yield host/domain clues; authentication still requires a supported identity and mechanism.

RCPT testing requires an SMTP transaction and servers may deliberately normalize responses. Treat automation as candidate generation and manually compare decisive responses.

Windows source position

# Variant — Windows source position
Test-NetConnection -ComputerName TARGET -Port PORT

This verifies TCP reachability only. Use an available Netcat/Ncat or OpenSSL client for protocol dialogue.

Next action: add confirmed/candidate names and domains to the private evidence ledger; test new names only in the later credential block. Do not send real mail or run relay checks unless the objective requires it.

POP3 and IMAP handoff

# POP3 and IMAP handoff
openssl s_client -connect TARGET:995 -crlf -quiet   # POP3S
openssl s_client -connect TARGET:993 -crlf -quiet   # IMAPS

POP3 dialogue

# POP3 dialogue
CAPA
USER USER
PASS PASSWORD
STAT
LIST
QUIT

# IMAP dialogue
a1 CAPABILITY
a2 LOGIN USER PASSWORD
a3 LIST "" "*"
a4 LOGOUT

Verify → Record response/control differences and separate inferred account existence from successful mailbox authentication.

If it fails → Uniform replies, disabled VRFY or a catch-all make username enumeration inconclusive; investigate other identity sources. More detail ↓

If → then

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Enumerate SMTP identities and accessible mailbox protocols

USE WHEN
SMTP capabilities or mail-related account clues
STARTING ACCESS
A confirmed reachable application; anonymous context or one identified credential
RESULT
Validated mail capabilities, possible usernames or authenticated mailbox artifacts

Recognize the clue

Identify mail-related listeners, inspect greeting/capabilities and compare permitted user-discovery replies with a known-invalid control.

nc -nv TARGET 25

Then enter the protocol dialogue:

EHLO example.invalid
VRFY USER
VRFY INVALID_CONTROL
QUIT
SYNTHETIC EXAMPLE OUTPUT
220 HOSTNAME ESMTP
250-VRFY
VRFY USER -> 250 USER
VRFY INVALID_CONTROL -> 550 No such user

Means: A reproducible reply difference can expose a possible mailbox identity.

Confirm: Check catch-all policy and account context; recipient acceptance does not prove mailbox credentials or OS access.

After validation
Controls support a real account and compatible credentials are available: validate its permitted mailbox/service access.
Ruled out in this context
All recipients are accepted by catch-all behavior: discard account-existence inference from this test.
Still inconclusive
Uniform policy replies leave usernames unknown; inspect another identity source.

Troubleshooting: Uniform replies, disabled VRFY or a catch-all make username enumeration inconclusive; investigate other identity sources.

Additional prerequisite checks

nc -nv TARGET 25

Recognize: SMTP commonly uses TCP/25, submission uses 587, and implicit TLS commonly uses 465. Goal: collect banner/capabilities, mail-domain clues and only defensible user evidence.

Baseline: banner and capabilities

Then enter:

Decisive output: 250- capability lines reveal extensions such as STARTTLS or AUTH. 250 after VRFY may support a valid mailbox; 550 commonly rejects or denies it; 252 explicitly means the server will not verify and is not proof that the user exists.

Variant — STARTTLS or implicit TLS

Run EHLO example.invalid after TLS negotiation. Certificate names and capabilities can yield host/domain clues; authentication still requires a supported identity and mechanism.

Variant — focused automated user checks

RCPT testing requires an SMTP transaction and servers may deliberately normalize responses. Treat automation as candidate generation and manually compare decisive responses.

Variant — Windows source position

This verifies TCP reachability only. Use an available Netcat/Ncat or OpenSSL client for protocol dialogue.

Failure cues: multiline replies begin with NNN- and finish with NNN ; read the final line. 503 often means the command sequence is wrong. Uniform 252 or 550 responses make enumeration inconclusive. A visible AUTH method does not mean anonymous relay or valid credentials.

Next action: add confirmed/candidate names and domains to the private evidence ledger; test new names only in the later credential block. Do not send real mail or run relay checks unless the objective requires it.

POP3 and IMAP handoff

Mail-access services expose mailbox capabilities and, with legitimate credentials, stored messages that may contain workflow or reset links.

POP3 dialogue:

IMAP dialogue:

Test one legitimately acquired credential. Capability output is not authentication; avoid brute-force NSE scripts until lockout/authorization is explicitly understood. Source supplement: reviewed getSH Nmap mail blocks.

Why it works

VRFY/RCPT differences may disclose account existence but catch-all policy can invalidate inference. A valid recipient is not an authenticated mailbox or operating-system login.

Worked example · hypothetical

Observation: two recipient probes produce different replies. Test: compare known-invalid controls and repeated responses. Illustrative output: only one candidate is consistently accepted. Interpretation: retain a possible username and check account context before authentication testing.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗