SMTP Attack Techniques
This page catalogs common attack techniques against SMTP servers and email infrastructure. Understanding these attacks is essential for both penetration testers and defenders.
Attackers exploit SMTP servers that are configured to relay messages from any source to any destination, allowing them to send spam or phishing emails anonymously.
Attackers use SMTP commands like VRFY, EXPN, and RCPT TO to validate email addresses, building lists of valid accounts for further attacks.
Attackers inject SMTP commands into web applications that send emails, allowing them to modify message content, add recipients, or send unauthorized messages.
A sophisticated attack that exploits differences in how email servers interpret message boundaries to bypass security controls and authentication mechanisms.
Attackers intercept and modify SMTP traffic to prevent the use of TLS encryption, forcing the server to transmit sensitive data in plaintext.
Attackers send emails with forged sender addresses to impersonate trusted entities, often bypassing or exploiting weaknesses in SPF, DKIM, and DMARC.
Techniques for attacking SMTP authentication, including brute force attacks, credential interception, and authentication bypass methods.
Attackers target vulnerabilities in complex email relay chains, exploiting trust relationships between servers to bypass security controls.
Attackers inject additional headers into emails, potentially adding BCC recipients, changing reply-to addresses, or modifying content types for XSS attacks.
Attack Methodology
Most SMTP attacks follow a common methodology:
- Reconnaissance - Identifying mail servers and gathering information
- Scanning - Probing for open ports and services
- Vulnerability Analysis - Identifying weaknesses in the SMTP implementation
- Exploitation - Leveraging discovered vulnerabilities
- Post-Exploitation - Maintaining access or extracting data
Defensive Considerations
Understanding these attacks is essential for implementing effective defenses:
- Proper SMTP server configuration to prevent open relay
- Implementation of email authentication (SPF, DKIM, DMARC)
- TLS encryption for all SMTP communications
- Input validation in web applications that send emails
- Regular security testing and monitoring of email infrastructure
- User awareness training to recognize phishing and social engineering
Reminder: The techniques described on this page should only be used in authorized penetration testing scenarios. Unauthorized testing or attacks against email systems is illegal and unethical.