By nature, all the e-mail systems sit on the Internet and allow external anonymous access from the outside world in order to be productive. Users in many organizations send sensitive information over e-mail. In most environments, e-mail servers hold valuable information making them a high priority target for attackers. The good news for consumers is that correctly configured modern e-mail systems are extremely difficult to exploit. This does not mean e-mail systems are not vulnerable to attacks since most e-mail systems have web applications and are accessed through a web interface. This promotes the possibility of a remote attacker gaining access to a core system that could be leveraged as a jumping point to other internal systems.
Before we target mail servers, it is important to know what systems are hosting the mail servers. If you do not have this information, you can use the Reconnaissance techniques we learned in Chapter 2, Reconnaissance. In this example...