# SMTP Enumeration (Port 25)
## Quick Intro
* Used to send, receive, and relay outgoing emails
* Used port 25
* Main attacks are user enumeration and using an open relay to send spam
## NSE
```
nmap 192.168.1.101 --script=smtp* -p 25
nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 $ip
```
## User Enumeration
```
smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t $ip
for server in $(cat smtpmachines); do echo "******************" $server "*****************"; smtp-user-enum -M VRFY -U userlist.txt -t $server;done #for multiple servers
# For multiple servers
```
## Connection
```
telnet $ip 25
```
### Command to check if a user exists
```
VRFY root
```
### Command to ask the server if a user belongs to a mailing list
```
EXPN root
```
## Brute Force
```
hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V
```
## Send email using netcat
{% embed url="" %}