> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/ports/25-smtp.md). # Port 25 | SMTP Identify hosts running SMTP. ```bash nmap -sV -p 25,465,587 --open ``` Identify available SMTP commands. ``` nmap --script smtp-commands -p25 ``` Those above script will identify all commands. The following below can be used to grep for methods to be used with `smtp-user-enum` for user identification. ``` nmap --script smtp-commands -p25 | grep -Eo 'VRFY|EXPN|RCPT' ``` ![](/files/-MfXXbUzP5t0OpzdVJ2-) With verified methods `smtp-user-enum` can be used to identify users from a given word list. ``` smtp-user-enum -U -M VRFY -t ``` ![](/files/-MfXXe6LYcdG7r9ooqLP) ### Metasploit ``` use auxiliary/scanner/smtp/smtp_enum ``` ## Sending Emails ```bash # mutt echo "" | mutt -s "" -r -a # SendEmail sendEmail -t -f -s -u -a # Swaks swaks -s "" -t "" -f "" --header "Subject:" --body "" --attach ```