📧Email Services Attacks
🎯 Overview
This document covers exploitation techniques against Email Services (SMTP/POP3/IMAP), focusing on practical attack methodologies from HTB Academy's "Attacking Common Services" module. Email attacks can lead to user enumeration, mail relay abuse, credential harvesting, and email-based social engineering.
"A mail server handles and delivers email over a network, usually over the Internet. Email servers are complex and usually require us to enumerate multiple servers, ports, and services. Most companies today have their email services in the cloud with services such as Microsoft 365 or G-Suite."
🏗️ SMTP Attack Methodology
Attack Chain Overview
Service Discovery → User Enumeration → Mail Relay Testing → Credential Attacks → Social EngineeringKey Attack Objectives
User enumeration via SMTP commands
Mail relay abuse for spam/phishing
Credential harvesting through SMTP authentication
Information disclosure via SMTP banners
Social engineering using email spoofing
📍 Service Discovery & Enumeration
MX Record Enumeration
HTB Academy MX Record Examples
Cloud vs Custom Mail Servers
Email Service Port Enumeration
HTB Academy Complete Port List
Email Service Ports Reference
Key Information to Extract
Mail server type (Cloud vs Custom implementation)
SMTP server software (Postfix, Sendmail, Exchange)
Version information for vulnerability research
Supported authentication methods
Mail relay configuration
Domain information from banners
👥 User Enumeration Attacks
SMTP User Enumeration Commands
VRFY Command (HTB Academy Example)
EXPN Command (HTB Academy Example)
RCPT TO Command (HTB Academy Example)
POP3 User Enumeration (HTB Academy Example)
HTB Academy User Enumeration Example
Using smtp-user-enum Tool (HTB Academy Example)
Alternative Enumeration Methods
☁️ Cloud Enumeration (Office 365)
O365spray Tool (HTB Academy Example)
Validate Office 365 Domain
Office 365 User Enumeration
Cloud Service Enumeration Tools
📨 Protocol Specific Attacks
Open Mail Relay Exploitation
Understanding Open Relay
HTB Academy Open Relay Detection
HTB Academy Open Relay Exploitation with Swaks
Manual Open Relay Testing
Additional Relay Testing Tools
🔐 Password Attacks
Traditional Email Service Attacks
HTB Academy Hydra Password Spray Example
Additional Hydra Examples
Cloud Service Password Attacks
HTB Academy O365 Password Spraying
Cloud-Specific Tools
🎯 HTB Academy Lab Scenarios
Scenario 1: SMTP User Enumeration
Scenario 2: SMTP Relay Testing
Scenario 3: Information Gathering
📋 SMTP Attack Checklist
Discovery & Enumeration
User Enumeration
Exploitation
Post-Exploitation
🛡️ Defense & Mitigation
SMTP Server Hardening
Disable VRFY/EXPN - Prevent user enumeration
Configure relay restrictions - Prevent open relay
Implement authentication - Require SMTP AUTH
Rate limiting - Prevent brute force attacks
Banner customization - Hide version information
Email Security
SPF records - Sender Policy Framework
DKIM signatures - DomainKeys Identified Mail
DMARC policy - Domain-based Message Authentication
TLS encryption - Secure mail transmission
Content filtering - Malware and spam protection
Monitoring & Detection
Failed authentication logs - Brute force detection
Unusual mail patterns - Anomaly detection
User enumeration attempts - VRFY/EXPN monitoring
Relay abuse detection - External recipient tracking
Rate limiting alerts - High-volume email detection
🚀 HTB Academy Lab Scenarios
Lab Exercise 1: SMTP User Enumeration
Lab Exercise 2: Email Access & Flag Extraction
Key Lab Learning Points
🔧 Tools & Resources
Essential Email Service Tools
Useful Nmap SMTP Scripts
🔗 Related Techniques
Email Reconnaissance - Information gathering
Social Engineering - Email-based attacks
Phishing - Malicious email campaigns
Domain Attacks - DNS-based email attacks
Password Attacks - SMTP credential attacks
📚 References
HTB Academy - Attacking Common Services Module
RFC 5321 - Simple Mail Transfer Protocol
smtp-user-enum - SMTP user enumeration tool
OWASP Email Security - Email attack vectors
Postfix Documentation - SMTP server configuration
This document provides comprehensive SMTP attack methodologies based on HTB Academy's "Attacking Common Services" module, focusing on practical exploitation techniques for penetration testing and security assessment.
Last updated