SMTP, POP3, IMAP, SNMP Enumeration for Pentesting
Introduction
SMTP enumeration turns an open port 25 into a finding that you can file during reporting: the product and version on the banner, whether VRFY or EXPN will hand out usernames, and whether the host will relay mail it should refuse.
We can use that same order on POP3 (110), IMAP (143), and SNMP (161/UDP), so you read what the service advertises, stay on authorized non-destructive probes, and keep patch-level risk separate from misconfiguration.
This is Part 3 of our port enumeration blog series. Part 1 covered FTP and SSH enumeration. Part 2 covered HTTP and HTTPS enumeration. Here the focus is mail transport and retrieval, plus SNMP management exposure.
Mail and SNMP Enumeration in Penetration Testing
Mail stacks and SNMP agents often leak users, configs, and network inventory with little traffic. The checks below stay on ports 25, 110, 143, and 161, so you can record versions, accounts, and misconfigurations without noisy or destructive tests.
SMTP Enumeration (Port 25)
SMTP (Simple Mail Transfer Protocol) on port 25 sends mail. Enumeration on that port is banner grabbing, supported commands, user probes (VRFY/EXPN), and an open-relay check.
SMTP Banner and EHLO
Connect and read the banner, then send EHLO so the server lists the extensions it will actually negotiate:
nc -nv 192.168.1.10 25
# Then type:
EHLO localhost
A typical EHLO reply might look like this (hostnames and limits vary by build):
220 mta.ciberbots.local ESMTP Exim 4.96
250-mta.ciberbots.local Hello localhost
250-SIZE 36700160
250-STARTTLS
250-AUTH PLAIN LOGIN
250-PIPELINING
250 HELP
Note the MTA name from the 220 line and any AUTH or STARTTLS tokens in the 250 list. Nmap can pull the same fields without a manual session:
nmap -p 25 -sV --script smtp-commands,smtp-open-relay 192.168.1.10
SMTP User Enumeration (VRFY, EXPN, RCPT)
Many SMTP servers still answer VRFY (verify user) or EXPN (expand list). When they do, you can probe for valid usernames without sending a message:
nc -nv 192.168.1.10 25
VRFY root
VRFY admin
VRFY postmaster
EXPN admin
250 + address = user likely exists.
550 or 551 = user not found or disabled.
RCPT TO during a fake session can answer the same question if you script it against a wordlist. Record which method returns a real distinction, and stay inside scope. Modern MTAs often enable anti-harvesting catch-alls that answer 250 OK to every RCPT TO, so a wall of positives can mean every address was accepted, not that every user exists.
SMTP Open Relay Check
An open relay accepts mail for domains it does not host and forwards it. Test that only when the engagement allows it:
nmap -p 25 --script smtp-open-relay -Pn 192.168.1.10
Or a quick manual check (replace the domain with one the server does not host; still only when authorized):
EHLO localhost
MAIL FROM:<you@yourdomain.com>
RCPT TO:<external@externaldomain.com>
A 250 OK on that RCPT TO, before DATA or authentication, means the server may be an open relay, so document that exchange and report it. Some servers defer the decision until DATA, so run the Nmap script when the manual RCPT TO is inconclusive.
SMTP Enumeration Quick Reference
Goal | Tool / method |
|---|---|
Banner / EHLO | nc -nv <ip> 25 then EHLO localhost |
Commands | nmap --script smtp-commands |
User enum | Manual VRFY / EXPN or scripts (e.g. smtp-enum-users) |
Open relay | nmap --script smtp-open-relay or manual RCPT TO test |
Separating SMTP version risk from config failures
Version risk and config risk are different tickets, so treat them that way when you write the SMTP finding. Version risk is a specific Postfix, Exchange, or Sendmail build that maps to a vendor advisory, which means you need the exact product and version from the banner and EHLO lines before you file a CVE claim. Config risk shows up even on current builds: VRFY or EXPN left on, an open relay that accepts RCPT TO for foreign domains, or no STARTTLS so AUTH and message bodies stay cleartext. A patched MTA that still relays spam is still a critical finding. Attach the VRFY transcript or the RCPT TO sequence that returned 250, so the mail team can reproduce it without guessing which probe you used.
POP3 Enumeration (Port 110)
POP3 on port 110 retrieves mail. Enumeration there is mostly the banner and, if you already have credentials, a folder list. User enumeration is less common than on SMTP.
POP3 Banner and CAPA
nc -nv 192.168.1.10 110
# Optional after connect:
CAPA
Example:
+OK POP3 server ready (Dovecot)
The +OK line is the product and version, so write that down before you leave the session.
nmap -p 110 -sV -sC 192.168.1.10
POP3 Authentication
POP3 usually takes USER and PASS. With valid credentials, LIST shows message numbers and sizes, and RETR n pulls message n, which is post-access enumeration rather than a pre-auth probe. Before you have credentials, stay on the banner and CAPA, and skip brute force unless the scope says otherwise.
IMAP Enumeration (Port 143)
IMAP on port 143 also retrieves mail, usually with folders and flags. Enumeration is the banner, CAPABILITY, and, after you authenticate, a folder list.
IMAP Banner and CAPABILITY
nc -nv 192.168.1.10 143
# Then:
a001 CAPABILITY
Example:
* OK [CAPABILITY IMAP4rev1 ...] Courier-IMAP ready
a001 OK CAPABILITY completed
nmap -p 143 -sV --script imap-capabilities 192.168.1.10
Write down the server name and the capability list (AUTH=PLAIN, LOGINDISABLED, and similar). LOGINDISABLED means cleartext LOGIN is not offered until STARTTLS, so do not treat a missing plaintext login as a finding. After you authenticate, LIST "" lists folders and SELECT opens one, which is how you enumerate mail once you are in.
POP3 and IMAP Enumeration Quick Reference
Goal | Tool / method |
|---|---|
POP3 banner | nc -nv <ip> 110 ; optional CAPA |
IMAP banner | nc -nv <ip> 143 ; a001 CAPABILITY |
Versions | nmap -p 110,143 -sV |
POP3 and IMAP report notes worth keeping
Pre-auth POP3 and IMAP findings are usually the greeting and the capability list, so quote the +OK line or the CAPABILITY response verbatim. Name the product when the banner shows it (Dovecot, Courier-IMAP, and similar), and note whether STARTTLS or an equivalent is advertised. Call out LOGINDISABLED on IMAP when it appears, because that flag decides whether cleartext LOGIN is offered before encryption. If scope includes valid credentials and you use LIST, SELECT, or RETR, record that mailboxes were readable and summarize the exposure class. Keep full message bodies in a restricted evidence store, not in the client-facing report. Do not force a CVE narrative onto a banner-only finding unless the version string maps to a real advisory.
SNMP Enumeration (Port 161)
SNMP (Simple Network Management Protocol) on port 161 (UDP) is the monitoring and management plane. Default community strings (public for read, private for read-write) and exposed MIBs can leak device info, interfaces, and sometimes credentials.
SNMP Community String and Version
SNMP v1 and v2c use community strings instead of usernames. The strings you will see first are the defaults:
public – read-only
private – read-write (dangerous if exposed)
Probe with snmpget (Linux):
snmpget -v2c -c public 192.168.1.10 1.3.6.1.2.1.1.1.0
That OID is sysDescr, the system description. A response means the public community string works, so try private next, then any string you already pulled from a config or a wordlist.
nmap -p 161 -sU --script snmp-info,snmp-interfaces 192.168.1.10
SNMP is UDP, so use -sU and expect timeouts. A rate floor such as --min-rate 1000 keeps that UDP scan from stalling. On Linux, snmpget and snmpwalk come from the net-snmp package. On Windows, use Nmap, or install net-snmp or a GUI such as iReasoning. SNMP v3 uses authentication and encryption, so community-string probes do not apply to a v3-only agent, and you should enumerate v3 only when you have credentials or the scope allows it. Still send the legacy public string, because many devices run v2c beside v3 or accept a downgrade, and v3 presence alone does not mean the community probe is wasted.
SNMP MIB Walk (System and Interfaces)
Once a read community string answers, walk the system subtree so you get a name, an OS string, and the interfaces in one pull:
snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.1
This can reveal:
1.3.6.1.2.1.1.1.0 – sysDescr (OS, hardware)
1.3.6.1.2.1.1.5.0 – sysName
1.3.6.1.2.1.2 – interfaces (names, types)
Those three values are the device type, OS, and interface list you need for network mapping and a later pivot, so put them in the host notes before you leave the agent.
SNMP Enumeration Quick Reference
Goal | Tool / method |
|---|---|
Community test | snmpget -v2c -c public <ip> 1.3.6.1.2.1.1.1.0 |
Info / ifaces | nmap -p 161 -sU --script snmp-info,snmp-interfaces |
Full walk | snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.1 |
Why SNMP community exposure usually beats version bugs
On SNMP, a weak community string and a wide listen address usually matter more than an agent CVE. File a version finding only when sysDescr, or an equivalent, names a build with a known advisory. The findings that change network risk fastest are public still answering from untrusted networks, private reachable for writes, or SNMP listening on the internet when it belongs on a management VLAN.
A working read-write community is an unauthenticated config channel on many devices, because snmpset can change interfaces or routing. Report the community that worked, the OIDs you could read or write, and whether the agent was reachable outside the intended management path, because that last detail is often the real fix.
Safe vs Unsafe Mail and SNMP Probes
Banner grabbing, EHLO, CAPA, CAPABILITY, and a single VRFY or EXPN check are safe, and they generate so little traffic that mail servers already see the same probes from other scanners and from servers negotiating capabilities. A scripted VRFY or EXPN run against a long wordlist is not safe in the same way: it looks like spam harvesting, and it can trip the mail server's own defenses or get a call from the client's mail admin mid-engagement, so keep those wordlists short and paced.
An open-relay check is safe as one RCPT TO confirmation, but stop before DATA, and never deliver mail to a real external address. A test that "succeeds" by dropping spam in someone's inbox is not an acceptable result.
SNMP reads with snmpget and snmpwalk, using a known or guessed read-only community string, are safe and non-destructive. Do not run snmpset against a production device outside a maintenance window, because a successful write can change routing, interface state, or trap destinations on live gear.
Summary: Port Enumeration Checklist for Pentesting
The three parts in this series cover the ports you will see first:
21 – FTP: banner, anonymous, FEAT
22 – SSH: banner, auth methods, algorithms
80 / 443 – HTTP/HTTPS: headers, directories, TLS/cert
25 – SMTP: EHLO, VRFY/EXPN, relay
110 – POP3: banner, CAPA
143 – IMAP: banner, CAPABILITY
161 – SNMP: community strings, sysDescr, interfaces
Keep one order on each host: banner, then version, then the safe probes, then the notes. A small table per host (port, service, version, findings) keeps the report and any later exploitation tied to what you actually saw.
References
Register for instructor-led online courses today! https://www.darkrelay.com/courses
Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths
Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing
Contact us for custom pentesting needs at: info@darkrelay.com or WhatsApp.
Comments