> For the complete documentation index, see [llms.txt](https://pentesting.mrw0l05zyn.cl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.mrw0l05zyn.cl/explotacion/servicios/25-tcp-465-tcp-587-tcp-smtp-s.md).

# 25/TCP, 465/TCP, 587/TCP (SMTP/S)

## Open relay

```sh
nmap -p 25,465,587 --script=smtp-open-relay.nse <target>
```

```sh
telnet <target> 25
HELO idontexist
MAIL FROM: attacker@example.com
RCPT TO: victim@anotherdomain.com
DATA
Subject: Test open relay
Test message
.
QUIT
```