Enumerating SMTP Servers with NMAP

NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some general and specific information about a remote host running the SMTP Service.

smtp-enum-users

Enumerate possible mail users on the remote machine.

sam@asus:~/unix% nmap -p 25 --script=smtp-enum-users 192.168.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-27 15:50 MDT
Nmap scan report for smtp.acme.com (192.168.0.27)
Host is up (0.00021s latency).
PORT   STATE SERVICE
25/tcp open  smtp
| smtp-enum-users: 
|   root
|_  test

Nmap done: 1 IP address (1 host up) scanned in 0.87 seconds
sam@asus:~/unix% 

smtp-open-relay

Checking for SMTP Open Relays

sam@asus:~/unix% nmap -p 25 --script=smtp-open-relay 192.168.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-27 15:51 MDT
Nmap scan report for smtp.acme.com (192.168.0.27)
Host is up (0.00061s latency).
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-open-relay: Server is an open relay (16/16 tests)

Nmap done: 1 IP address (1 host up) scanned in 0.81 seconds
sam@asus:~/unix% 

smtp-commands

To see the avaiable commands on the remote server, user the 'smtp-commands' script.

sam@asus:~/unix% nmap -p 25 --script=smtp-commands 192.168.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-27 15:52 MDT
Nmap scan report for smtp.acme.com (192.168.0.27)
Host is up (0.00022s latency).
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-commands: asus, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 

Nmap done: 1 IP address (1 host up) scanned in 0.76 seconds
sam@asus:~/unix%