> For the complete documentation index, see [llms.txt](https://pentesting.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.mrw0l05zyn.cl/escaneo-y-enumeracion/servicios/25-tcp-465-tcp-587-tcp-smtp-s.md).

# 25/TCP, 465/TCP, 587/TCP (SMTP/S)

## Banner grabbing

```shell
nc -vn <target> 25
```

## Vulnerabilidades

```shell
nmap -p 25,465,587 --script=vuln <target> -oN nmap-vuln-SMTP.txt
nmap -p 25,465,587 --script=smtp-open-relay.nse <target>
```

## Enumeración

### Nmap

```shell
nmap -p 25 --script smtp-enum-users.nse <target> -oN nmap-enum-users-SMTP.txt
```

### smtp-user-enum

```shell
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t <target> | tee smtp-user-enum-vrfy-top.txt
smtp-user-enum -M EXPN -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t <target> | tee smtp-user-enum-expn-top.txt
smtp-user-enum -M RCPT -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t <target> | tee smtp-user-enum-rcpt-top.txt
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -t <target> | tee smtp-user-enum-vrfy.txt
```

### VRFY

```shell
nc -vn <target> 25
HELO idontexist
VRFY <user>
```

### EXPN

```shell
nc -vn <target> 25
HELO idontexist
EXPN <user>
```

### RCPT TO

```shell
nc -vn <target> 25
HELO idontexist
MAIL FROM: user@example.com
RCPT TO: <user>
```