Lion Cipher Lab
Enumerate SMTP usernames with VRFY, EXPN and RCPT
- Penetration Testing / Red Team
- Beginner
- ~35 min
- Free · no account required
Why it matters
Almost every attack that starts with a login form starts one step earlier, with a list of real usernames. If an attacker can hand a mail server a name and be told, reliably, whether that account exists, they can turn a giant wordlist into a short list of confirmed employees before they ever try a single password. That confirmed list is what makes PASSWORD SPRAYING viable — one common password tried against many real accounts, quietly, under the lockout threshold — and it is what makes phishing land, because an email to a name that exists is read and an email to a name that does not bounces…
What you'll learn
- explaining what SMTP username enumeration IS, and why a list of valid accounts is worth the attacker's time (it feeds password spraying and targeted phishing)
- reading the SMTP conversation as plain text over netcat, and interpreting the reply codes 250, 251, 252, 550 and 551 the way the server means them
- using VRFY and EXPN by hand to tell a real account from an invented one, and knowing why those two commands exist and why modern servers switch them off
- using the MAIL FROM / RCPT TO technique to enumerate even when VRFY is disabled, because RCPT has to make an accept-or-reject decision
- automating the whole thing with smtp-user-enum against a wordlist in each of its VRFY, EXPN and RCPT modes
- closing the hole on your own server: disable_vrfy_command, uniform responses, and rate limiting, then re-measuring to prove valid and invalid now look identical
- judgment: recognising that many real servers already return uniform replies, so this attack fails on them — which is exactly the state your fix is trying to reach
Steps in this lab
- What SMTP username enumeration is, and why an attacker wants a list of your accounts
- VRFY and EXPN — the two commands that were built to answer this question
- Stand up a leaky mail server on your OWN lab
- Attack it by hand — netcat, VRFY, and the 250-vs-550 split
- When VRFY is off: the MAIL FROM / RCPT TO technique
- Automate it with smtp-user-enum against a wordlist
- Fix it: disable VRFY/EXPN, make responses uniform, rate-limit
- Re-measure — prove valid and invalid are now indistinguishable
- Judgment — where this fits, and how not to fool yourself with it