Chapter 6. Auditing Mail Servers

Note

This chapter shows you how to do some things that in many situations might be illegal, unethical, a violation of the terms of service, or just not a good idea. It is provided here to give you information that may be of use to protect yourself against threats and make your own system more secure. Before following these instructions, be sure you are on the right side of the legal and ethical line... use your powers for good!

In this chapter, we will cover:

• Discovering valid e-mail accounts using Google Search

• Detecting open relays

• Brute forcing SMTP passwords

• Enumerating users in an SMTP server

• Detecting backdoor SMTP servers

• Brute forcing IMAP passwords

• Retrieving the capabilities of an IMAP mail server

• Brute forcing POP3 passwords

• Retrieving the capabilities of a POP3 mail server

• Detecting vulnerable Exim SMTP servers version 4.70 through 4.75