Collecting valid e-mail accounts

Valid e-mail accounts are very handy to penetration testers since they can be used for exploiting trust relationships in phishing attacks, brute-force password auditing to mail servers, and as usernames in many IT systems.

This recipe illustrates how to get a list of valid public e-mail accounts by using Nmap.

Getting ready

The script http-google-email is not included in Nmap's official repository. So you need to download it from and copy it to your local scripts directory. After copying http-google-email.nse, you should update the script database with:

#nmap --script-updatedb

How to do it...

Open your favorite terminal and type:

$nmap -p80 --script http-google-email,http-email-harvest <target>

You should see something similar to the following output:

Nmap scan report for insecure.org (74.207.254.18)
Host is up (0.099s latency).
rDNS record for 74.207.254.18: web.insecure.org
PORT   STATE SERVICE
80/tcp open  http
| http-google-email:
|_fyodor@insecure...