E-mail accounts used as usernames are very common in web applications, and finding them is a necessary task when auditing mail servers. Enumerating users via SMTP commands can obtain excellent results, and thanks to the Nmap Scripting Engine we can automate this task.
This recipe shows how to enumerate users on an SMTP server by using Nmap.
To enumerate users of an SMTP server by using Nmap, enter the following command:
$ nmap -p25 –script smtp-enum-users <target>
Any usernames found will be included in the script output section:
Host script results: | smtp-enum-users: |_ RCPT, webmaster
The script smtp-enum-users was written by Duarte Silva, and it attempts to enumerate users in SMTP servers by using the SMTP commands RCPT, VRFY, and EXPN.
The SMTP commands RCPT, VRFY, and EXPN can be used to determine if an account exists or not on the mail server. Let's take a look at the VRFY command only, as they all work in a similar...