37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS

37.5 SMTP Enumeration

By Ravindra Bagale · Last updated: 27 September 2026

SMTP (port 25) mail pathavto – pan junya servers VRFY / EXPN ne usernames confirm kartat. Attacker valid mailbox list banavto, mag phishing/password spray.

# Manual enum via nc / telnet (Metasploitable often has SMTP)
nc 192.168.56.20 25
# After banner, try (type carefully; quit with QUIT):
# HELO lab.local
# VRFY root
# VRFY nosuchuser
# EXPN root
# RCPT TO:<root@localhost>   # sometimes works after MAIL FROM
# QUIT

Nmap scripts (lab):

nmap -p 25 --script smtp-enum-users --script-args smtp-enum-users.methods=VRFY,EXPN,RCPT 192.168.56.20

Defence: VRFY ani EXPN disable (Postfix / Sendmail config); rate-limit RCPT; require auth for relay; do not expose SMTP submission to the whole internet without controls; monitor failed RCPT floods. Aata pudhe jaauya.