Skip to main content
Solved

Question of the day 10/09, Cybersecurity Edition

  • September 12, 2022
  • 7 comments
  • 42 views
marcofabbri
Forum|alt.badge.img+12

Day 9

What is the command that enumerate email addresses present on a SMTP server?

  • HASH
  • VRFY
  • READ
  • EXPN
  • RCPT TO

Best answer by marcofabbri

This one was tricky. Correct answer was EXPN, VRFY and RCPT TO 😋

All three commands are good to enumeration email addresses on a SMTP server.

Here’s an example:
 

VRFY command, and EXPN is very similar.
RCPT TO command

 

Backups are like pizza, I love them. | Linkedin: @marco-fabbri-it
dips
Link State
marcofabbri

7 comments

dips
Forum|alt.badge.img+7
  • dips
  • On the path to Greatness
  • September 12, 2022

VERIFY or should that be VRFY 😉

Dipen N. K. | IT Security Specialist | Veeam Legend 2022 - 2025 | Cyber Security Space VUG Leader
Chris.Childerhose
Link State
marcofabbri
marcofabbri
Forum|alt.badge.img+12
  • marcofabbri
  • Author
  • On the path to Greatness
  • September 12, 2022

VERIFY or should that be VRFY 😉

Thanks, corrected. Monday morning...

Backups are like pizza, I love them. | Linkedin: @marco-fabbri-it
Chris.Childerhose
dips
Link State
dips
Forum|alt.badge.img+7
  • dips
  • On the path to Greatness
  • September 12, 2022

I know the feeling. Just need that coffee

Dipen N. K. | IT Security Specialist | Veeam Legend 2022 - 2025 | Cyber Security Space VUG Leader
Chris.Childerhose
Link State
wolff.mateus
Chris.Childerhose
Forum|alt.badge.img+21
  • Chris.Childerhose
  • Veeam Legend, Veeam Vanguard
  • September 12, 2022

RCPT TO

Chris Childerhose - VMCA2024 | VMCE2023 | VMCE-SP2024 | Veeam Vanguard 8* | Veeam Legend 5* | VUG Canada Leader | vExpert 6* | Toronto VMUG Leader | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
Chris.Childerhose
wolff.mateus
JMeixner
Forum|alt.badge.img+16
  • JMeixner
  • On the path to Greatness
  • September 12, 2022

VRFY

But this command can be a security problem, because you can extract valid email addresses and use them for further attacks against server and try them as login names…. You cannot disable it completely because the RFC requests it. You can configure it that it gives no real information instead….

Jochen (Joe) Meixner | Veeam Vanguard 2024 | Veeam Legend 2021 - 2024 | Veeam Certified Architect (VMCA) | Veeam Certified Engineer (VMCE) | LinkedIn: https://www.linkedin.com/in/jochen-meixner | X: @JoMeix | BlueSky: @jmeixner.bsky.social
Chris.Childerhose
wolff.mateus
Chris.Childerhose
Forum|alt.badge.img+21
  • Chris.Childerhose
  • Veeam Legend, Veeam Vanguard
  • September 12, 2022

RCPT TO

Correction - should be VRFY 😂

Chris Childerhose - VMCA2024 | VMCE2023 | VMCE-SP2024 | Veeam Vanguard 8* | Veeam Legend 5* | VUG Canada Leader | vExpert 6* | Toronto VMUG Leader | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
Chris.Childerhose
wolff.mateus
marcofabbri
Forum|alt.badge.img+12
  • marcofabbri
  • Author
  • On the path to Greatness
  • Answer
  • September 13, 2022

This one was tricky. Correct answer was EXPN, VRFY and RCPT TO 😋

All three commands are good to enumeration email addresses on a SMTP server.

Here’s an example:
 

VRFY command, and EXPN is very similar.
RCPT TO command

 

Backups are like pizza, I love them. | Linkedin: @marco-fabbri-it
Chris.Childerhose
Terms & ConditionsAccessibility statement