🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

SMTP Overview

<aside> 📌 SMTP is the protocol for sending emails, while POP3 and IMAP are the protocols for retrieving emails.

By default, SMTP servers accept connection requests on port 25. However, newer SMTP servers also use other ports such as TCP port 587. This port is used to receive mail from authenticated users/servers, usually using the STARTTLS command to switch the existing plaintext connection to an encrypted connection. The authentication data is protected and no longer visible in plaintext over the network.

</aside>

Common Commands

Command Description
AUTH PLAIN AUTH is a service extension used to authenticate the client.
HELO The client logs in with its computer name and thus starts the session.
MAIL FROM The client names the email sender.
RCPT TO The client names the email recipient.
DATA The client initiates the transmission of the email.
RSET The client aborts the initiated transmission but keeps the connection between client and server.
VRFY The client checks if a mailbox is available for message transfer.
EXPN The client also checks if a mailbox is available for messaging with this command.
NOOP The client requests a response from the server to prevent disconnection due to time-out.
QUIT The client terminates the session.

Common Attack Vectors

<aside> 📌 Phishing. If port 25 and 110 open. Send an email with a shell message using port 25 [SMTP] and retrieve it with IMAP or POP3 ports:

If you gain access:

Common Ports

Port Service
TCP/25 SMTP Unencrypted
TCP/143 IMAP4 Unencrypted
TCP/110 POP3 Unencrypted
TCP/465 SMTP Encrypted
TCP/993 IMAP4 Encrypted
TCP/995 POP3 Encrypted

Common Tools