Skip to content
HackIndex.io
SMTP
Service

SMTP

Mail transfer service for sending emails.

:25 :465 :587 5 guides 3 phases
1 min read Created: Dec 28, 2025 Updated: Jul 13, 2026

SMTP (Simple Mail Transfer Protocol) handles email delivery and runs on TCP port 25 (relay), TCP port 465 (SMTPS, implicit TLS), and TCP port 587 (submission with STARTTLS). Nmap identifies it as smtp. Common servers include Postfix, Exim, Sendmail, and Microsoft Exchange.

SMTP servers can leak valid usernames through the VRFY and EXPN commands or by observing RCPT TO responses. Open relays allow sending spoofed emails, which is useful for phishing. Misconfigured servers may accept mail without authentication.

Enumerate the server version from the banner, then test for user enumeration with smtp-user-enum. Check if the server is an open relay. If credentials are available, test authenticated access on the submission port.

Enumeration

Enumerate SMTP banners, auth methods, and NTLM info via nmap and openssl

1

SMTP enumeration

Techniques for enumerating valid users and gathering SMTP server info using VRFY, EXPN, and RCPT TO commands during reconnaissance.

Jan 18, 2026 • 4 min read

Vulnerability Discovery

Guides on testing SMTP for open relays and user enumeration

2

Exploitation

Guides on relay abuse, spoofed email delivery, and auth brute force

2

SMTP Credential Attacks

Exploiting SMTP authentication weaknesses via brute force, credential stuffing, and relay abuse to gain unauthorized mail server access.

Mar 29, 2026 • 2 min read