Port 25 is the standard SMTP port for server-to-server email relay but is often blocked due to spam abuse; port 587 is the recommended default for secure email submission, while port 465 is a legacy.
Last updated
sudo nmap --script smtp-enum-users -p25 <IP>
sudo nmap --script smtp-open-relay,smtp-commands,smtp-ntlm-info -p25 <IP> ## ------------------| smtp-user-enum
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 10.10.10.17
smtp-user-enum -U /usr/share/seclists/Usernames/Honeypot-Captures/multiplesources-users-fabian-fingerle.de.txt -m 50 -M RCPT -D humongousretail.com -t 10.10.10.17
## ------------------| Metasploit
msfconsole
use auxiliary/scanner/smtp/smtp_enum
set RHOSTS $IP
set USER_FILE /usr/share/seclists/Usernames/Names/names.txt
set THREADS 10
set RPORT 25
run
## ------------------| Bash Script
for i in $(cat /usr/share/seclists/Usernames/Names/names.txt);do echo -e "HELO test.com\nVRFY $i\nQUIT" | nc -nv $IP 25 | grep -E "250|550"; donetelnet <SMG_IP_address> 587
EHLO mailserver.com
AUTH LOGIN
<Username_in_base64> # echo -n "username" | base64
<Password_in_base64> # echo -n "password" | base64## !! Be aware about from address. If you are using same domain for both from and to. they will ask auth. So please use [email protected] first !!
## ------------------| Using Swaks
swaks --from [email protected] --to [email protected] --header 'Subject: Hello world' --body 'This is msg body' --server 10.10.10.197
## ------------------| Using sendEmail
sendEmail -m 'Hello machan' -f [email protected] -t [email protected] -s <IP> -u "Message Subject" -a attachment.pdf
sendEmail -o message-file=message.txt -f [email protected] -t [email protected] -s <IP> -u "Message Subject" -a attachment.pdf
## ------------------| Using Telnet
telnet <IP> 25
HELO writer.htb
MAIL FROM:[email protected]
RCPT TO:[email protected]
DATA
Subject: Test mail
Hello h4rith
.
QUIT
## ------------------| Using NetCat
nc <IP> 25
HELO writer.htb
MAIL FROM:[email protected]
RCPT TO:[email protected]
DATA
Subject: Test mail
Hello h4rith
.
QUIT
## ------------------| Using NodeJS
const nodemailer = require('nodemailer');
const transporter = nodemailer.createTransport({
host: 'smtp.example.com', // Your provider's SMTP server
port: 587, // Common: 587 (STARTTLS), 465 (SSL), 25 (non-auth, old)
secure: false, // true for 465, false for other ports
auth: {
user: '[email protected]', // Your email address
pass: 'your_password_or_app_password'
}
});
// Optional: For self-signed certs or debugging
// tls: {
// rejectUnauthorized: false
// }
const mailOptions = {
from: '"HarithD" <[email protected]>',
to: '[email protected]',
subject: 'SMTP Test',
text: 'Test email',
// html: '<p>HTML body with <strong>custom SMTP</strong></p>'
};
transporter.sendMail(mailOptions, (error, info) => {
if (error) {
return console.error('Send error:', error);
}
console.log('Email sent:', info.response);
});## ------------------| Using smtpd (deprecated)
import smtpd
import asyncore
class CustomSMTPServer(smtpd.SMTPServer):
def __init__(self, localaddr, remoteaddr):
smtpd.SMTPServer.__init__(self, localaddr, remoteaddr)
def process_message(self, peer, mailfrom, rcpttos, data):
print('Received email from:', mailfrom)
print('To:', rcpttos)
print('Message:', data)
server = CustomSMTPServer(('0.0.0.0', 1025), None)
asyncore.loop()
## ------------------| Using asyncio
import asyncio
from aiosmtpd.controller import Controller
class CustomSMTPHandler:
async def handle_RCPT(self, server, session, envelope, address, rcpt_options):
envelope.rcpt_tos.append(address)
return '250 OK'
async def handle_DATA(self, server, session, envelope):
print('Received email from:', envelope.mail_from)
print('To:', envelope.rcpt_tos)
print('Message:', envelope.content.decode('utf-8'))
return '250 OK'
async def main(loop):
handler = CustomSMTPHandler()
controller = Controller(handler, hostname='localhost', port=1025)
controller.start()
loop = asyncio.get_event_loop()
loop.run_until_complete(main(loop))