# SMTP Penetration Testing

> This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

- Skill: `dokhacgiakhoa/smtp-penetration-testing` (Agent Skill, multi-file: 25 files)
- Install (CLI): `npx skillmds@latest add dokhacgiakhoa/smtp-penetration-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dokhacgiakhoa/smtp-penetration-testing/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: Dokhacgiakhoa (https://skillmd.com/u/dokhacgiakhoa)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/dokhacgiakhoa/smtp-penetration-testing

---


# SMTP Penetration Testing

## Purpose

Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration. This skill covers banner grabbing, user enumeration techniques, relay testing, brute force attacks, and security hardening recommendations.

## Prerequisites

## 🧠 Knowledge Modules (Fractal Skills)

### 1. [Required Tools](./sub-skills/required-tools.md)
### 2. [Required Knowledge](./sub-skills/required-knowledge.md)
### 3. [Required Access](./sub-skills/required-access.md)
### 4. [Phase 1: SMTP Architecture Understanding](./sub-skills/phase-1-smtp-architecture-understanding.md)
### 5. [Phase 2: SMTP Service Discovery](./sub-skills/phase-2-smtp-service-discovery.md)
### 6. [Phase 3: Banner Grabbing](./sub-skills/phase-3-banner-grabbing.md)
### 7. [Phase 4: SMTP Command Enumeration](./sub-skills/phase-4-smtp-command-enumeration.md)
### 8. [Phase 5: User Enumeration](./sub-skills/phase-5-user-enumeration.md)
### 9. [Phase 6: Open Relay Testing](./sub-skills/phase-6-open-relay-testing.md)
### 10. [Phase 7: Brute Force Authentication](./sub-skills/phase-7-brute-force-authentication.md)
### 11. [Phase 8: SMTP Command Injection](./sub-skills/phase-8-smtp-command-injection.md)
### 12. [Phase 9: TLS/SSL Security Testing](./sub-skills/phase-9-tlsssl-security-testing.md)
### 13. [Phase 10: SPF, DKIM, DMARC Analysis](./sub-skills/phase-10-spf-dkim-dmarc-analysis.md)
### 14. [Essential SMTP Commands](./sub-skills/essential-smtp-commands.md)
### 15. [SMTP Response Codes](./sub-skills/smtp-response-codes.md)
### 16. [Enumeration Tool Commands](./sub-skills/enumeration-tool-commands.md)
### 17. [Common Vulnerabilities](./sub-skills/common-vulnerabilities.md)
### 18. [Legal Requirements](./sub-skills/legal-requirements.md)
### 19. [Technical Limitations](./sub-skills/technical-limitations.md)
### 20. [Ethical Boundaries](./sub-skills/ethical-boundaries.md)
### 21. [Example 1: Complete SMTP Assessment](./sub-skills/example-1-complete-smtp-assessment.md)
### 22. [Example 2: User Enumeration Attack](./sub-skills/example-2-user-enumeration-attack.md)
### 23. [Example 3: Open Relay Exploitation](./sub-skills/example-3-open-relay-exploitation.md)
### 24. [For Administrators](./sub-skills/for-administrators.md)