search
LinkedInGithub
githubEdit

7. SMTP

hashtag
I. Email Basics

Function: Handles and delivers email. Protocols:

  • SMTP (Simple Mail Transfer Protocol): Sending emails.

  • POP3 (Post Office Protocol 3): Receiving emails (typically removes from server).

  • IMAP4 (Internet Message Access Protocol 4): Receiving emails (keeps on server).

Ports:

  • SMTP: TCP/25 (unencrypted), TCP/465 (encrypted), TCP/587 (encrypted/STARTTLS)

  • POP3: TCP/110 (unencrypted), TCP/995 (encrypted)

  • IMAP4: TCP/143 (unencrypted), TCP/993 (encrypted)

Attack Vectors:

  • Misconfigurations (anonymous access, weak protocols).

  • User enumeration.

  • Password attacks (spraying, brute-forcing).

  • Exploiting vulnerabilities (e.g., open relay, CVE-2020-7247).

  • Credential reuse attacks.

  • Email spoofing/phishing.

hashtag
II. Enumeration

MX Records (Mail Exchanger):

  • MXToolbox website

  • DNSdumpster for passive recon

A Records (IP Address):

SPF, DKIM, and DMARC Records:

Nmap (for custom mail servers):

hashtag
III. Misconfigurations

SMTP User Enumeration:

smtp-user-enum tool:

POP3 User Enumeration:

hashtag
IV. Cloud Enumeration

Office 365:

Google Workspace Enumeration:

hashtag
V. Password Attacks

Hydra:

Cloud Services (Office 365):

MailSniper (Office 365):

hashtag
VI. Protocol-Specific Attacks

Open Relay:

SMTP Spoofing (Manual Test):

hashtag
VII. Latest Email Service Vulnerabilities

  • CVE-2020-7247 (OpenSMTPD):

    • RCE vulnerability (exploitable since 2018).

    • Affects OpenSMTPD up to version 6.6.2.

    • No authentication required.

    • Shodan.io for finding potentially vulnerable servers.

  • CVE-2021-27211 (Exim):

    • Improper validation of recipient address.

    • Can lead to RCE.

hashtag
VIII. Additional Tools

  • Amass for passive DNS enumeration.

  • Shodan for discovering exposed mail servers.

  • TheHarvester for gathering email addresses.

  • Censys for advanced reconnaissance.

Previous6. DNSNextAttacking Common Applications

Last updated