312-50V13 · Question #447
What useful information is gathered during a successful Simple Mail Transfer Protocol (SMTP) enumeration?
The correct answer is A. The two internal commands VRFY and EXPN provide a confirmation of valid users, email. A successful SMTP enumeration allows an attacker to identify valid user accounts and mailing lists on a target mail server.
Question
Options
- AThe two internal commands VRFY and EXPN provide a confirmation of valid users, email
- BReveals the daily outgoing message limits before mailboxes are locked
- CThe internal command RCPT provides a list of ports open to message traffic.
- DA list of all mail proxy server addresses used by the targeted host
How the community answered
(64 responses)- A91% (58)
- B3% (2)
- C2% (1)
- D5% (3)
Why each option
A successful SMTP enumeration allows an attacker to identify valid user accounts and mailing lists on a target mail server.
During SMTP enumeration, the VRFY (verify) command is used to confirm if a specific user exists on the mail server, and the EXPN (expand) command is used to identify the members of a mailing list. Successful execution of these commands provides a confirmation of valid users and email addresses, which is valuable information for attackers.
SMTP enumeration does not reveal daily outgoing message limits, as this is typically an internal server configuration not exposed through standard enumeration commands.
The RCPT (recipient) command is used to specify the recipient of an email and does not provide a list of open ports; port scanning identifies open ports.
SMTP enumeration primarily focuses on user and mailing list existence, not on identifying mail proxy server addresses, which are typically found through DNS records or network reconnaissance.
Concept tested: SMTP enumeration techniques
Source: https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp
Topics
Community Discussion
No community discussion yet for this question.