Enumerating SMTP usernames

Email accounts used as usernames are very common in web applications. Having access to an email account could mean access to sensitive data, including more credentials for other services. Unfortunately, as attackers, sometimes we don't even have a username list. So, finding valid users is one of the very first steps when auditing mail servers. Enumerating users via SMTP commands can obtain excellent results, and thanks to the NSE, we can automate this task.

This recipe shows how to enumerate users on an SMTP server with Nmap.

How to do it...

To enumerate users of an SMTP server with Nmap, enter the following command:

$ nmap -p25 --script smtp-enum-users <target>

Any usernames found will be included in the script output section:

'Host script results:
| smtp-enum-users:
|_   RCPT, webmaster

How it works...

The smtp-enum-users script was written by Duarte Silva, and it attempts to enumerate users in SMTP...