HOWTO use NMAP to SMTP Enumeration

Run the command nc -nv 25 to check the mail server.


VRFY bob send us a SMTP success code 250, while failure send SMTP code 550. We will use the SMTP success code 250 in a script in the next example.

This is a sample of SMTP Enumeration using users.txt that you collect through passive gathering. The command for user in $(cat users.txt); do echo VRFY $user |nc -nv -w 1 25 2>/dev/null |grep ^”250″;done script.

For list in users.txt, do echo with VRFY command with each user name and pipe that with netcat which will connect to the mail server on port 25 and redirect any error messages to /dev/null, then with the remaining output look for lines that begin with 250 the SMTP code for a success result. Then complete the loop, see the results below.


How about using Python script? Here’s an example file.


Import the Python module such as socket and sys, parameter check to make the syntax is use correctly. The script will connect to the SMTP server on port 25, receive the banner and print it.

Once printed, the script will send the VRFY command together with the username, then print the result and close the socket.

Run the script, verify username bob.

#./ bob [enter]; you will see the result of 250 2.1.5 <>

and for unknown user.

#./ idontexist [enter]; result 550 5.1.1 idontexist … User unknown

Please continue reading other HOWTO articles.



Support @QUE.COM

Founder, QUE.COM Internet Media. | Founder, a Shout for Joy! | MAJ.COM Management of Assets and Joint Ventures. More at KING.NET Ideas to Life.

Leave a Reply