# Enumeration

> Enumerate SMTP banners, auth methods, and NTLM info via nmap and openssl

- **URL:** https://hackindex.io/services/smtp/enumeration
- **Service:** [SMTP](https://hackindex.io/services/smtp.md)
- **Tags:** services, users, endpoints
- **Published:** 2026-01-18
- **Updated:** 2026-03-29

SMTP enumeration reveals valid email addresses, internal usernames, and server configuration before you send a single exploit. VRFY and EXPN commands confirm whether a mailbox or alias exists, while RCPT TO probes work even when the first two are disabled. Banner grabbing identifies the MTA software and version, narrowing your attack surface immediately.

Tools like smtp-user-enum, nmap's smtp-enum-users script, and manual Telnet sessions let you cycle through wordlists fast. AUTH method enumeration (PLAIN, LOGIN, CRAM-MD5) tells you which credential attacks are viable and whether credentials travel in cleartext. Relay testing at this stage flags misconfigurations you can exploit later.

Every valid address you pull here feeds brute-force, phishing, and social engineering in later phases. Accurate enumeration keeps the noise low and the hit rate high.

## Guides

- [SMTP enumeration](https://hackindex.io/services/smtp/enumeration/smtp-enumeration.md): Techniques for enumerating valid users and gathering SMTP server info using VRFY, EXPN, and RCPT TO commands during reconnaissance.