SMTP User Enumeration

in#bug•

SMTP stands for Simple Mail Transfer Protocol is a TCP/IP protocol for sending E-mail messages between servers.SMTP usually is implemented to operate over Internet port 25. Nmap (Network Mapper) is the most popular port scanner which is designed to probe a server or host for open ports. The following are the open ports that I identified on Open-xchange’s Sandbox domain sandbox.open-xchange.com (185.27.181.34) Port Scanning Via Nmap

The SMTP user enumeration can be performed automatically via Metasploit, smtp_enum module will connect to a given mail server and use a wordlist to enumerate users that are present on the remote system. SMTP User Enumeration Via Metasploit

This leakage can be avoided by disallowing the execution of the commands EXPN,VRFY and RCPT.

After reporting this issue, Open-xchange resolved the vulnerability and rewarded me the bounty and it was my first bug bounty :)

#bounty

·in#bug·by

$0.00

Sort:

Congratulations @akashc99! You have completed some achievement on Steemit and have been rewarded with new badge(s) :

You published your First Post You made your First Vote You got a First Vote You made your First Comment

Click on any badge to view your own Board of Honor on SteemitBoard. For more information about SteemitBoard, click here

If you no longer want to receive notifications, reply to this comment with the word STOP

By upvoting this notification, you can help all Steemit users. Learn how here!

$0.00

Congratulations @akashc99! You received a personal award!

Happy Birthday! - You are on the Steem blockchain for 2 years!

_{You can view your badges on your Steem Board and compare to others on the Steem Ranking}

Vote for @Steemitboard as a witness to get one more award and increased upvotes!

$0.00

Hi. I am a volunteer bot for @resteembot that upvoted you. Your post was chosen at random, as part of the advertisment campaign for @resteembot. @resteembot is meant to help minnows get noticed by re-steeming their posts

To use the bot, one must follow it for at least 3 hours, and then make a transaction where the memo is the url of the post. If you want to learn more - read the introduction post of @resteembot. If you want help spread the word - read the advertisment program post.

Steem ON!

$0.00