SMTP Enumeration

Key Commands

Command	Description
VRFY	Ask server to verify an email address exists
EXPN	Ask server for membership of a mailing list

These commands can be abused to verify existing users on a mail server and guess valid usernames.

Ports: 25 (SMTP), 465 (SMTPS), 587 (submission).

Manual Enumeration with Netcat

nc -nv $TARGET 25
VRFY root
VRFY admin

When VRFY/EXPN are disabled, the RCPT TO method often still leaks valid users — the server accepts the recipient for a real mailbox and rejects unknown ones:

HELO x
MAIL FROM:<test@x.com>
RCPT TO:<root>
RCPT TO:<nonexistent>

Tools

Automated user enumeration with smtp-user-enum (try each mode — some servers only answer one):

smtp-user-enum -M VRFY -U users.txt -t $TARGET
smtp-user-enum -M RCPT -U users.txt -D $DOMAIN -t $TARGET

Nmap scripts (banner/commands, user enum, open relay):

nmap -p 25 --script smtp-commands,smtp-enum-users,smtp-open-relay $TARGET

Metasploit module: auxiliary/scanner/smtp/smtp_enum. On Windows, Test-NetConnection and telnet cover manual checks.

---

SNMP Enumeration

Protocol: UDP (port 161)

SNMP protocols v1, v2, and v2c offer no traffic encryption — SNMP information and credentials can be easily intercepted. Traditional SNMP also has weak authentication schemes and is commonly left configured with default public and private community strings.

warning

SNMPv3 is the only version that provides authentication and encryption. Earlier versions transmit everything in plaintext.

Discovery

Scan for SNMP on a subnet:

sudo nmap -sU --open -p 161 $SUBNET -oG open-snmp.txt

onesixtyone

Brute force community strings against a list of IPs:

onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt $TARGET

snmpwalk

Enumerate SNMP data (requires knowing the read-only community string, often public):

snmpwalk -v2c -c public $TARGET          # walk everything
snmpwalk -v1  -c public $TARGET          # some devices only answer v1

Target specific OIDs for the highest-value data:

snmpwalk -v2c -c public $TARGET 1.3.6.1.4.1.77.1.2.25    # Windows users
snmpwalk -v2c -c public $TARGET 1.3.6.1.2.1.25.4.2.1.2   # running processes
snmpwalk -v2c -c public $TARGET 1.3.6.1.2.1.25.6.3.1.2   # installed software
snmpwalk -v2c -c public $TARGET 1.3.6.1.2.1.6.13.1.3     # listening TCP ports
snmpwalk -v2c -c public $TARGET 1.3.6.1.2.1.25.4.2.1.4   # process paths

snmp-check

Target is a positional argument; -c sets the community string (-t is the timeout, not the target):

snmp-check $TARGET -c public
snmp-check $TARGET -c public -v 2c