How do I install the Smtp Pentesting skill?

Run npx skillmds@latest add abelrguezr/smtp-pentesting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Smtp Pentesting safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Smtp Pentesting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Smtp Pentesting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Smtp Pentesting?

abelrguezr (@abelrguezr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Smtp Pentesting by abelrguezr — Agent Skill

Name: Smtp Pentesting
Rating: 4.666666666666667 (3 reviews)
Author: abelrguezr

Smtp Pentesting

SMTP enumeration and security testing skill. Use this skill whenever you need to test SMTP servers, enumerate email addresses, check SMTP configurations, or perform security assessments on mail servers. This includes tasks like verifying email addresses, testing SMTP commands, checking for open relays, analyzing SMTP server responses, or documenting SMTP security findings. Make sure to use this skill when the user mentions SMTP, email servers, mail enumeration, or any email-related security testing.

abelrguezr Updated Sep 10, 2026

File contents

SMTP Pentesting

A skill for testing and enumerating SMTP servers during security assessments.

Overview

SMTP (Simple Mail Transfer Protocol) is the standard protocol for email transmission. This skill helps you enumerate SMTP servers, test their configurations, and identify potential security issues.

Common SMTP Commands

Connection Commands

HELO - Initiates SMTP conversation with sender's domain

HELO example.com

EHLO - Extended SMTP, requests server capabilities

EHLO example.com

Email Transfer Commands

MAIL FROM - Specifies sender address

MAIL FROM:<sender@example.com>

RCPT TO - Specifies recipient address (repeat for multiple recipients)

RCPT TO:<recipient@example.com>

DATA - Begins email content transfer

DATA

Information Gathering Commands

VRFY - Verifies if email/username exists

VRFY username

EXPN - Expands mailing list members

EXPN listname

HELP - Requests server information

HELP

Control Commands

RSET - Resets current transaction

RSET

QUIT - Terminates SMTP session

QUIT

Testing Workflow

1. Connect to SMTP Server

Use telnet or netcat to establish a connection:

# Standard SMTP (port 25)
telnet target.com 25

# Or with netcat
nc target.com 25

# SMTPS (port 465)
openssl s_client -connect target.com:465

# Submission (port 587)
telnet target.com 587

2. Gather Server Information

Send EHLO to see supported extensions:

EHLO yourdomain.com

Look for:

Supported authentication methods (AUTH)
Maximum message size (SIZE)
TLS/SSL support (STARTTLS)
Server banner information

3. Test Email Verification

Use VRFY to check if specific addresses exist:

VRFY admin
VRFY root
VRFY postmaster
VRFY user@domain.com

Note: Many servers disable VRFY for security. If VRFY returns 252 or 550, try RCPT TO with DATA to verify.

4. Check for Open Relay

Test if the server accepts mail for external domains:

MAIL FROM:<test@external.com>
RCPT TO:<victim@external.com>
DATA
Subject: Test

.

If the server accepts this, it may be an open relay.

5. Test Authentication

Check AUTH capabilities:

EHLO yourdomain.com
# Look for AUTH line in response
AUTH LOGIN
AUTH PLAIN
AUTH CRAM-MD5

6. Analyze Responses

Common SMTP response codes:

2xx - Success
3xx - Intermediate, continue
4xx - Temporary failure
5xx - Permanent failure

Security Considerations

Always obtain authorization before testing SMTP servers
Be aware of rate limiting and potential blocking
Document findings responsibly
Follow responsible disclosure practices

Example Session

$ telnet mail.example.com 25
Trying 192.168.1.100...
Connected to mail.example.com.
220 mail.example.com ESMTP Postfix

EHLO test.local
250-mail.example.com Hello
250-SIZE 10240000
250-AUTH LOGIN PLAIN
250 OK

VRFY admin
250 admin <admin@example.com>

MAIL FROM:<pentester@company.com>
250 Ok

RCPT TO:<admin@example.com>
250 Ok

QUIT
221 Bye

Common Findings

VRFY enabled - Allows email enumeration
EXPN enabled - Reveals mailing list members
Open relay - Server accepts mail for any domain
Weak authentication - No AUTH required or weak methods
Banner information - Server version exposed
No TLS/SSL - Unencrypted transmission

Best Practices

Test from authorized networks only
Use proper sender addresses
Don't send actual spam or malicious content
Document all findings with timestamps
Report vulnerabilities through proper channels

---name: smtp-pentestingdescription: SMTP enumeration and security testing skill. Use this skill whenever you need to test SMTP servers, enumerate email addresses, check SMTP configurations, or perform security assessments on mail servers. This includes tasks like verifying email addresses, testing SMTP commands, checking for open relays, analyzing SMTP server responses, or documenting SMTP security findings. Make sure to use this skill when the user mentions SMTP, email servers, mail enumeration, or any email-related security testing.---# SMTP PentestingA skill for testing and enumerating SMTP servers during security assessments.## OverviewSMTP (Simple Mail Transfer Protocol) is the standard protocol for email transmission. This skill helps you enumerate SMTP servers, test their configurations, and identify potential security issues.## Common SMTP Commands### Connection Commands**HELO** - Initiates SMTP conversation with sender's domain```HELO example.com```**EHLO** - Extended SMTP, requests server capabilities```EHLO example.com```### Email Transfer Commands**MAIL FROM** - Specifies sender address```MAIL FROM:<sender@example.com>```**RCPT TO** - Specifies recipient address (repeat for multiple recipients)```RCPT TO:<recipient@example.com>```**DATA** - Begins email content transfer```DATA```### Information Gathering Commands**VRFY** - Verifies if email/username exists```VRFY username```**EXPN** - Expands mailing list members```EXPN listname```**HELP** - Requests server information```HELP```### Control Commands**RSET** - Resets current transaction```RSET```**QUIT** - Terminates SMTP session```QUIT```## Testing Workflow### 1. Connect to SMTP ServerUse telnet or netcat to establish a connection:```bash# Standard SMTP (port 25)telnet target.com 25# Or with netcatnc target.com 25# SMTPS (port 465)openssl s_client -connect target.com:465# Submission (port 587)telnet target.com 587```### 2. Gather Server InformationSend EHLO to see supported extensions:```bashEHLO yourdomain.com```Look for:- Supported authentication methods (AUTH)- Maximum message size (SIZE)- TLS/SSL support (STARTTLS)- Server banner information### 3. Test Email VerificationUse VRFY to check if specific addresses exist:```bashVRFY adminVRFY rootVRFY postmasterVRFY user@domain.com```**Note:** Many servers disable VRFY for security. If VRFY returns 252 or 550, try RCPT TO with DATA to verify.### 4. Check for Open RelayTest if the server accepts mail for external domains:```bashMAIL FROM:<test@external.com>RCPT TO:<victim@external.com>DATASubject: Test.```If the server accepts this, it may be an open relay.### 5. Test AuthenticationCheck AUTH capabilities:```bashEHLO yourdomain.com# Look for AUTH line in responseAUTH LOGINAUTH PLAINAUTH CRAM-MD5```### 6. Analyze ResponsesCommon SMTP response codes:- **2xx** - Success- **3xx** - Intermediate, continue- **4xx** - Temporary failure- **5xx** - Permanent failure## Security Considerations- **Always obtain authorization** before testing SMTP servers- **Be aware of rate limiting** and potential blocking- **Document findings responsibly**- **Follow responsible disclosure practices**## Example Session```$ telnet mail.example.com 25Trying 192.168.1.100...Connected to mail.example.com.220 mail.example.com ESMTP PostfixEHLO test.local250-mail.example.com Hello250-SIZE 10240000250-AUTH LOGIN PLAIN250 OKVRFY admin250 admin <admin@example.com>MAIL FROM:<pentester@company.com>250 OkRCPT TO:<admin@example.com>250 OkQUIT221 Bye```## Common Findings1. **VRFY enabled** - Allows email enumeration2. **EXPN enabled** - Reveals mailing list members3. **Open relay** - Server accepts mail for any domain4. **Weak authentication** - No AUTH required or weak methods5. **Banner information** - Server version exposed6. **No TLS/SSL** - Unencrypted transmission## Best Practices- Test from authorized networks only- Use proper sender addresses- Don't send actual spam or malicious content- Document all findings with timestamps- Report vulnerabilities through proper channels

Frequently asked questions