Hack Like a Pro: How to Extract Email Addresses from an SMTP Server « Null Byte :: WonderHowTo

Welcome back, my budding hackers!If we are considering asocial engineering attackagainst a target, we are probably going to need email addresses. By having the email addresses of people within an organization, we can tailor our social engineering attack to particular people and circumstances within that organization (e.g., a sales report to the sales department) and maybe spoof the email address of a colleague within the organization. In this way, they are more likely to click on a link or open a document that we send them.There are multiple ways of collecting email addresses includingMaltego, an email harvester, and others, but what if we could go directly into the organization's SMTP server and ask it if an email address exits? Wouldn't that be best and most reliable method?Background on SMTPAs you know, SMTP stands for Simple Mail Transport Protocol and operates on port 25. Unlike POP3 and IMAP that operate over ports 110 and 143, respectively, SMTP is a server-to-server protocol. Clients use POP3 or IMAP to retrieve or send messages to the SMTP server, while the SMTP server then communicates to other SMTP servers.The SMTP server, obviously, maintains a database of every email address in the organization that it must send and receive email for. It is this database that we want to access and query.To find SMTP servers you can useNmapor another scanning tool and look for servers with port 25 open. If port 25 is open, it is likely an SMTP server. In addition, you can useDNSquerying to find the IP address of its SMTP server.SMTP CommandsThe SMTP protocol, like so many other protocols, has its own subset of commands. Here are a few of the most important SMTP commands.HELO- This is the command that the client sends to the server to initiate a conversation. Generally, the IP address or domain name must accompany this command, such as HELO 192.168.101 or HELO client.microsoft.com.EHLO- This command is the same as HELO, but communicates to the server that the client wants to use Extended SMTP. If the server does not offer ESMTP, it will still recognize this command and reply appropriately.STARTTLS- Normally, SMTP servers communicate in plaintext. To improve security, the connection between SMTP servers can be encrypted by TLS (Transport Layer Security). This command starts the TLS session.RCPT- Specifies the email address of the recipient.DATA- Starts the transfer of the message contents.RSET- Used to abort the current email transaction.MAIL- Specifies the email address of the sender.QUIT- Closes the connection.HELP- Asks for the help screen.AUTH- Used to authenticate the client to the server.VRFY- Asks the server to verify is the email user's mailbox exists.Step 1: Fire Up Kali & Open a TerminalNow that we covered the basics of SMTP, let's see if we can use this knowledge to hack the SMTP server to extract email addresses. Let's fire upKaliand open a terminal.Step 2: Telnet into the SMTP ServerOur next step is to see whether we can manually connect to the SMTP server using telnet.kali > telnet 192.168.1.101 25As you can see, we have successfully connected to the Metasploitable server via telnet.Step 3: Manually Try Email AddressesNow that we are connected via telnet to the SMTP server, we can use the SMTP commands listed above to query the server. Most importantly, we want to use the VRFY (verify) command. Using this command, followed by the email user name, will prompt the server to verify whether the user account exits, such as:> VRFY sysAs you can see in the screenshot above, I tried users:sysadminadministratornullbyterootThe server verified that "sys" and "root" have email accounts on the server. Great!Step 4: Use Smtp-User-EnumAs you could see in Step #3, we can manually query the SMTP server to see whether a particular email address exists. Wouldn't it be easier if we had a script that did this automatically? Fortunately, we do! It's calledsmtp-user-enumand it's built into Kali.We can find it at Applications -> Kali Linux -> Information Gathering - SMTP Analysis -> smtp-user-enum.When we click on it, a help screen like that below opens. Note that the basic syntax for using this tool to find email users is:kali > smtp-user-enum -M VRFY -U <userlist> -t <target IP>Now let's construct a command to use against the Metasploitable SMTP server. We can use any of the wordlists in Kali,createour own, or download any of thousands available on the Internet. I've decided to try one built into Kali at:/usr/share/fern-wifi-cracker/extras/wordlistUsing it, my command becomes:kali > smtp-user-enum -M VRFY -U /usr/sharefern-wifi-cracker/extras/wordlist -t 192.168.1.101As you can see in the screenshot below, we started it running and it first displays the scan information.Then, the users found.Now that we know what users are on that organization's email server, we can send social engineering emails to them or spoof their email addresses and send social engineering emails to their colleagues.Keep coming back, my budding hackers, as we continue to explore the art and technique of hacking!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Brute-Force Email Using a Simple Bash Script (Ft. THC Hydra)How To:Add Your iCloud Email Account to Your Galaxy Note 3 or Other Android DeviceHow To:Set up a Yahoo email account on your iPod TouchHow To:Set up an email account in MS OutlookHow To:Setup a new e-mail account in Outlook 2003How To:Configure Microsoft Entourage for a Gmail accountHow To:Set-up a new email address in MS Outlook ExpressHack Like a Pro:Abusing DNS for ReconnaissanceHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)How To:Set up POP3 settings for Outlook 2003/Outlook ExpressHack Like a Pro:The Ultimate Social Engineering HackHow To:Make Your Remote Screenshot Captor(Python)How To:Enable a Live/Hotmail account in Mac's MailHow To:Hide @iCloud, @Me & Custom Aliases from Your Mail App's 'From' Field on Your iPhoneHow To:Change Your FaceTime Caller ID to an Email Address or Phone NumberHack Like a Pro:How to Spy on Anyone, Part 2 (Finding & Downloading Confidential Documents)How To:Set-up your Gmail account with OutlookHow To:Stop Gmail from Automatically Loading Images in Your EmailsHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHow To:Make a Gmail Notifier in PythonHow To:Code a Basic TCP/IP Client & Server Duo in PythonNews:ShouldIChangeMyPassword.comHow To:Make a Change-of-IP Notifier in PythonHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesDon't Get Doxed:5 Steps to Protecting Your Private Information on the WebHow To:Fix Your Notification Settings in Google+ PagesGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsThe Ultimate Guide:Diagnosing & Fixing Connection Issues, Part IINews:How-To-Generate Thousands Of Valid Email IDsGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHow To:Really Connect Your Words with Friends Mobile Account to FacebookMastering Security, Part 2:How to Create a Home VPN TunnelNews:Learning (and Teaching) The Use of BCC in EmailsNews:Tips and Tricks for GmailNews:Basic Email Etiquette