Skip to content
HackIndex logo

HackIndex

SMTP enumeration

4 min read Mar 29, 2026

SMTP enumeration extracts server version, supported capabilities, authentication mechanisms, and internal hostnames from the banner and EHLO response. The three ports behave differently: port 25 is server-to-server and often leaks more, port 587 is submission and usually enforces AUTH and STARTTLS, port 465 uses implicit TLS. Always check all three and compare output — misconfigurations are often port-specific.

Service Discovery

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 25,465,587 $TARGET_IP 
25/tcp  open  smtp     Postfix smtpd
465/tcp open  ssl/smtp Postfix smtpd
587/tcp open  smtp     Postfix smtpd

Connect to port 25 and send EHLO to get the full capability list. The banner hostname often leaks internal naming useful for AD recon:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP 25 
220 mail.internal.company.com ESMTP Postfix (Ubuntu)
┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nQUIT' | nc -nv $TARGET_IP 25 
220 mail.internal.company.com ESMTP Postfix
250-mail.internal.company.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-8BITMIME
250 DSN

Note which capabilities are advertised: 250-STARTTLS means TLS is available but not required. 250-AUTH shows which authentication mechanisms are supported. 250-VRFY means user validation is enabled. Missing STARTTLS on port 587 is a misconfiguration — credentials sent there are plaintext on the wire.

NSE Script Enumeration

Run the SMTP NSE scripts for structured capability output and relay testing in one pass:

┌──(kali㉿kali)-[~]
└─$ nmap -p 25,465,587 --script smtp-commands,smtp-ntlm-info,smtp-open-relay $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nmap -p 25 --script smtp-commands $TARGET_IP 
| smtp-commands: mail.company.com
|   PIPELINING SIZE 10240000 VRFY ETRN STARTTLS AUTH PLAIN LOGIN
|_  HELP

STARTTLS and TLS Certificate

Upgrade to TLS on port 587 and check the certificate SANs for internal hostnames:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -starttls smtp -crlf -connect $TARGET_IP:587 2>/dev/null | grep -iE 'subject|issuer|DNS:' 
subject=CN=mail.company.com
DNS:mail.company.com, DNS:autodiscover.company.com, DNS:smtp.company.com
┌──(kali㉿kali)-[~]
└─$ openssl s_client -crlf -connect $TARGET_IP:465 2>/dev/null | grep -iE 'subject|DNS:'

Certificate SANs often reveal additional internal hostnames — autodiscover, OWA, and other Exchange-related endpoints — that are not in public DNS. Feed these into virtual host enumeration.

NTLM Info Extraction

Exchange and other Microsoft mail servers respond to an SMTP AUTH NTLM initiation with server metadata before completing authentication. This reveals domain name, hostname, and OS version without credentials:

┌──(kali㉿kali)-[~]
└─$ nmap -p 25,587 --script smtp-ntlm-info $TARGET_IP 
| smtp-ntlm-info:
|   Target_Name: COMPANY
|   NetBIOS_Domain_Name: COMPANY
|   NetBIOS_Computer_Name: MAIL01
|   DNS_Domain_Name: company.local
|   DNS_Computer_Name: mail01.company.local
|_  Product_Version: 10.0.17763

The domain name, computer name, and product version are immediately useful for AD targeting. Windows Server 2019 is version 10.0.17763. Feed the domain name into Kerberos enumeration and password spraying scope.

User Enumeration — VRFY and EXPN

VRFY and EXPN are often disabled on hardened servers but worth checking when enabled. A 250 response confirms the user exists:

┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nVRFY admin\nVRFY root\nVRFY postmaster\nQUIT' | nc -nv $TARGET_IP 25 
250 2.0.0 admin
550 5.1.1 <root>: Recipient address rejected
250 2.0.0 postmaster

User Enumeration — RCPT TO

RCPT TO works even when VRFY and EXPN are blocked. The server validates the recipient locally before accepting the message. A 250 response means the address is accepted:

┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nMAIL FROM:<[email protected]>\nRCPT TO:<admin@$DOMAIN>\nQUIT' | nc -nv $TARGET_IP 25 
250 2.1.5 Ok
┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nMAIL FROM:<[email protected]>\nRCPT TO:<nonexistent@$DOMAIN>\nQUIT' | nc -nv $TARGET_IP 25 
550 5.1.1 <[email protected]>: Recipient address rejected: User unknown

Automated User Enumeration

smtp-user-enum automates VRFY, EXPN, or RCPT testing against a wordlist. RCPT mode is most reliable:

┌──(kali㉿kali)-[~]
└─$ smtp-user-enum -M RCPT -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -D $DOMAIN -t $TARGET_IP -p 25 
[*] Trying RCPT method...
[+] [email protected] exists
[+] [email protected] exists
[-] [email protected] does not exist
┌──(kali㉿kali)-[~]
└─$ smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t $TARGET_IP -p 25

Build a confirmed user list for password spraying against OWA, SMTP submission, and other services. A 252 response to VRFY is not a positive — it means the server won't verify but will accept the message. Only treat 250 as confirmed. Move to open relay testing and user enumeration for dedicated methodology pages.

References