37. Enumeration: NetBIOS, SMB, SNMP, LDAP, SMTP, NFS and DNS
37.5 SMTP Enumeration
SMTP (port 25) mail pathavto – pan junya servers VRFY / EXPN ne usernames confirm kartat. Attacker valid mailbox list banavto, mag phishing/password spray.
# Manual enum via nc / telnet (Metasploitable often has SMTP)
nc 192.168.56.20 25
# After banner, try (type carefully; quit with QUIT):
# HELO lab.local
# VRFY root
# VRFY nosuchuser
# EXPN root
# RCPT TO:<root@localhost> # sometimes works after MAIL FROM
# QUIT
Nmap scripts (lab):
nmap -p 25 --script smtp-enum-users --script-args smtp-enum-users.methods=VRFY,EXPN,RCPT 192.168.56.20
Defence: VRFY ani EXPN disable (Postfix / Sendmail config); rate-limit RCPT; require auth for relay; do not expose SMTP submission to the whole internet without controls; monitor failed RCPT floods. Aata pudhe jaauya.
Ravindra Bagale's Tip
Students see VRFY succeed and think "hacked". It only confirms a username – it gives no access. But a list of valid users is gold for phishing. Defender: disable VRFY/EXPN + anti-spam. In interviews, explain both the attack and the steps to disable it.
Ravindra Bagale's Tip – मराठी
Students VRFY success बघून "hack झाला" समजतात. हे फक्त username confirm करते – access नाही. पण valid user list phishing साठी gold आहे. Defender: VRFY/EXPN बंद + anti-spam. Interview मध्ये attack + disable steps दोन्ही सांगा.
Ravindra Bagale's Tip – हिंदी
Students VRFY success देखकर समझते हैं "hack हो गया". यह सिर्फ़ username confirm करता है – access नहीं. पर valid user list phishing के लिए gold है. Defender: VRFY/EXPN बंद + anti-spam. Interview में attack + disable steps दोनों बताओ.
Lab
nc 192.168.56.20 25 ne banner grab kara. VRFY root ani ek random naav try kara – response code fark note kara (250 vs 550). Mag Postfix/Sendmail hardening note liha: "disable VRFY/EXPN". Real mail servers var permission shivay try karu naka.