Edit

SMTP

Learning Objectives

  • Master email protocols (SMTP, IMAP, POP3) as vectors for enumeration, credential theft, spoofing, and pivoting to internal networks.

  • Identify misconfigurations in on-prem (Exim/Postfix) vs. cloud (O365/GWS) deployments.

  • Execute attacks with evasion (e.g., proxy chaining for brute-force) and articulate mitigations (e.g., SPF/DMARC hardening).

  • New: Analyse email metadata for forensics and simulate phishing chains in reports.

Attack Surface Overview

# Common Vectors (Enhanced)
- Misconfigurations (open relay, anonymous VRFY/EXPN, weak TLS)
- User enumeration (VRFY/RCPT, cloud API leaks)
- Password attacks (brute-force, spraying, credential stuffing from breaches)
- Protocol exploits (SMTP smuggling, STARTTLS downgrade)
- Vulnerabilities (RCE in proxies, auth bypass in plugins)
- Spoofing/phishing (bypassing SPF/DKIM/DMARC)
- **New:** OAuth misconfigs (token replay in O365/GWS)
- **New:** Metadata exfil (e.g., via IMAP searches for PII)
- **New:** Supply-chain (vulnerable plugins like Post SMTP in WordPress)

Enumeration (Stealth → Aggressive)

Prioritise passive DNS recon to avoid direct probes. Use timing delays (--max-rate 50) for IDS evasion.

Instructions: Log all outputs (-oN enum.txt). Start passive (Amass/TheHarvester) for 80% intel without alerts. Cross-reference with Shodan for version fingerprinting (e.g., "Exim 4.97").

Report: "MX: mail.example.com → Exposed on 25/TCP → Risk: Open relay potential."

Authentication & Misconfigurations

Test for legacy auth (e.g., plain-text POP3). Document weak TLS (e.g., SSLv3 support).

Instructions: Use swaks for safe relay tests: swaks --server <IP> --from test@domain --to victim@domain --body "Test". If the relay works, note bounce addresses. For reporting: "Misconfig: VRFY enabled → Enum 50 users → Impact: Targeted phishing."

Cloud Enumeration & Attacks

Focus on API abuse; use proxies to evade lockouts.

Instructions: Limit to 1 req/sec in scripts (--delay 1). Test in lab O365 tenant (free trial). Report: "Cloud Enum: 20 valid users via o365spray → Spray weak passes → High impact (domain-wide compromise)."

Password Attacks

Incorporate spraying (same pass, many users) over brute-force to evade detection.

Instructions: Rotate proxies/VPNs every 50 attempts. Monitor for lockouts (e.g., 429 errors). Use SecLists wordlists tailored to seasons (e.g., "Password2025"). Report: "Spray: 5% success rate → Access to admin@ → Pivots to SharePoint."

Protocol-Specific Attacks

A. SMTP (Enhanced with Smuggling)

B. POP3/IMAP (New Section)

Instructions: For smuggling, validate with Wireshark (look for split commands). Clean up test mails post-attack. Evasion: Encode subjects in Base64. Report: "Spoof via open relay → Delivered phishing → Medium impact (social engineering vector)."

Latest CVEs (2024–2025) (Updated)

Instructions: Replicate in Docker (e.g., a vulnerable Exim image). Read NVD for each; note CVSS/impact. Include in reports: "CVE-2025-26794 unpatched → SQLi → RCE → Critical (full server access). Patch: Upgrade Exim."

Post-Exploitation & Persistence

Instructions: For persistence, test forwarding loops in the lab. Exfil to Burp for analysis. Report: "Post-Exploit: Added forward rule → Ongoing exfil → Mitigation: Audit rules quarterly."

Key Commands Summary (Copy-Paste Ready)

Prep & Practice Plan

Defensive Awareness (New): After labs, simulate blue-team (e.g., Snort rules for SMTP smuggling). Review RFC 5321 for protocol quirks.

PreviousSMBNextSQL

Last updated