A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of…

The correct answer is A. VRFY and EXPN. SMTP servers can also be used for information gathering by connecting to them and using the EXPN and VRFY commands. https://hackerone.com/reports/193314

Reconnaissance and enumeration

Question

A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of the following commands should be used to accomplish the goal?

Options

AVRFY and EXPN
BVRFY and TURN
CEXPN and TURN
DRCPT TO and VRFY

How the community answered

(58 responses)

A
90% (52)
B
2% (1)
C
3% (2)
D
5% (3)

Explanation

SMTP servers can also be used for information gathering by connecting to them and using the EXPN and VRFY commands. https://hackerone.com/reports/193314

Topics

#SMTP enumeration#User enumeration#VRFY command#EXPN command

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice