Lion Cipher Lab
Find and shut an open SMTP relay in your own lab
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
An open relay is one of the oldest and most consequential misconfigurations on the internet, and it is still worth checking for on an engagement because when it is present the impact is immediate and total. A mail server (an MTA — Mail Transfer Agent) exists to accept mail and forward it toward its destination. A CLOSED server only does that for its own users or its own domains: it relays for people it trusts, and refuses to be a forwarding service for strangers. An OPEN RELAY has lost that distinction — it will accept mail from anyone, claiming to be from anyone, addressed to anyone, and…
What you'll learn
- defining what an open SMTP relay is — a mail server that forwards mail from an arbitrary sender to an arbitrary external recipient — and why it is a real finding on an engagement, not a curiosity
- holding the SMTP conversation a pentester actually has: HELO/EHLO, MAIL FROM, RCPT TO, VRFY/EXPN, and reading the 3-digit reply codes (250 accept, 550/554 reject) to decide what a server will do
- standing up a real Postfix MTA, deliberately misconfigured as an open relay, in a single throwaway Docker container that touches nothing but your own machine
- writing the relay test in Python's stdlib smtplib: attempt to send from attacker@evil.test to victim@external.test and read the code Postfix returns at RCPT TO — the exact point a relay decision is made
- measuring the break: the open relay ACCEPTS the forward (3/3 attempts, 250 2.1.5 Ok)
- closing it with the two settings that matter — mynetworks restricted to loopback, and smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination — and understanding what each one independently does
- measuring the fix: the identical attempts are now refused 554 5.7.1 Relay access denied (0/3), while a legitimate local-to-local delivery still returns 250, so you did not simply break the server
- judgment and honesty: why a RCPT-TO rejection is not proof the server is fully locked (authenticated relay, backscatter), why one refused shape is not proof, why modern MTAs default closed, and why blocklists like Spamhaus punish open relays hard
Steps in this lab
- What an open relay is — and the one rule before you touch it
- The SMTP conversation a pentester actually has
- Stand up the deliberately-open relay: one Postfix container, your machine only
- The exploit: prove it relays, from Python
- Shut it: the two settings that close the relay
- Measure the fix: the same test, the opposite result
- Honest negatives: what a closed relay does NOT prove
- Do it better — recognise, report, prevent, and clean up