Skills smtp-penetration-testing
📦
smtp-penetration-testing
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access
Assess SMTP Server Security
Mail servers can expose users, relays, weak credentials, and missing authentication controls. This skill organizes authorized SMTP testing and remediation planning.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "smtp-penetration-testing" from https://skillstore.io/skills/sickn33-smtp-penetration-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-smtp-penetration-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "smtp-penetration-testing". Authorized notes show VRFY enabled, EXPN disabled, and STARTTLS available on the submission port.
Expected outcome:
- Finding: User enumeration is possible through VRFY responses.
- Impact: Attackers can validate mailboxes before phishing or password attacks.
- Fix: Disable VRFY or return uniform responses for unknown users.
Using "smtp-penetration-testing". Relay testing accepted an external recipient from an unauthenticated connection.
Expected outcome:
- Finding: The server appears to permit unauthorized relay.
- Impact: The service may be abused for spam or impersonation.
- Fix: Require authentication or restrict relay by trusted networks only.
Using "smtp-penetration-testing". DNS review finds SPF soft fail, no DMARC policy, and missing DKIM evidence.
Expected outcome:
- Finding: Email authentication is incomplete.
- Impact: Spoofed messages may be harder for recipients to reject.
- Fix: Publish aligned SPF, DKIM, and DMARC records with monitoring.
Security Audit
Criticalv6 • 7/9/2026 Open versioned report
I confirmed critical and high-risk findings for Metasploit usage, Nmap scanning, SMTP user enumeration, relay testing, credential brute force, and spoofing workflows. Some Markdown backtick and private IP detections are false positives, but the skill still contains direct operational attack guidance. Legal and ethical cautions are present, but they do not neutralize the misuse risk.
1
Files scanned
501
Lines analyzed
76
Review items
0
False positives ignored
Confirmed security concerns (39)
Critical
Metasploit framework
# Metasploit Framework
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
Using Metasploit:
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
Using Metasploit:
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
Using Metasploit:
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
| Metasploit | `use auxiliary/scanner/smtp/smtp_enum` |
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
# Method 3: Metasploit
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Critical
Metasploit framework
set USER_FILE /usr/share/metasploit-framework/data/wordlists/unix_users.txt
The skill explicitly references Metasploit modules for SMTP enumeration, relay testing, or login attacks. This is exploit-framework guidance, not an incidental mention.
Show all 39 confirmed findings
Critical
Phishing Preparation Guidance
The skill labels user enumeration as preparation for phishing and shows how discovered accounts can be listed as valid users.
The scenario explicitly says user enumeration is for phishing preparation, and the example shows valid accounts being found.
Critical
Credential Brute Force Workflow
The skill provides a complete SMTP authentication attack workflow using Hydra, Medusa, and Metasploit with user and password lists.
The section is titled brute force authentication and lists operational tooling, target parameters, and password file inputs.
High
System reconnaissance
2. **User Enumeration Results** - Valid email addresses discovered
The cited line supports discovering valid SMTP users, including an example framed as phishing preparation. This reconnaissance can enable targeted credential attacks and social engineering.
High
System reconnaissance
Enumerate valid email addresses:
The cited line supports discovering valid SMTP users, including an example framed as phishing preparation. This reconnaissance can enable targeted credential attacks and social engineering.
High
System reconnaissance
**Scenario:** Enumerate valid users for phishing preparation
The cited line supports discovering valid SMTP users, including an example framed as phishing preparation. This reconnaissance can enable targeted credential attacks and social engineering.
High
System reconnaissance
# Results show valid users
The cited line supports discovering valid SMTP users, including an example framed as phishing preparation. This reconnaissance can enable targeted credential attacks and social engineering.
High
Network scanning tools
# Nmap with SMTP scripts
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
sudo apt-get install nmap
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -p 25,465,587,2525 -sV TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -sV -sC -p 25 TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap --script=smtp-* -p 25 TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
# Using Nmap
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -sV -p 25 TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
Using Nmap:
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap --script smtp-enum-users -p 25 TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} -p 25 TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
# Using Nmap
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -p 25 --script smtp-open-relay TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap --script ssl-enum-ciphers -p 25 TARGET_IP
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
| Nmap | `nmap --script smtp-enum-users -p 25 IP` |
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -sV -sC -p 25,465,587 mail.target.com
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -p 25 --script smtp-open-relay mail.target.com
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
# Document with Nmap
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
nmap -p 25 --script smtp-open-relay --script-args smtp-open-relay.from=test@attacker.com,smtp-open-r
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Network scanning tools
| Connection Refused | Port blocked or closed | Check port with nmap; ISP may block port 25; try 587
The skill provides Nmap-based SMTP service discovery, enumeration, cipher checks, or open-relay testing. These are active network-scanning instructions against target mail servers.
High
Email Spoofing Social Engineering Example
The skill includes a spoofed CEO message with an urgent request, which can support impersonation and social engineering.
The example uses a CEO identity and urgent instruction text, showing a realistic impersonation pattern rather than a purely defensive check.
High
Hidden Recipient Header Injection Guidance
The skill demonstrates adding a hidden Bcc recipient and malicious header during SMTP DATA submission.
The section is explicitly about command injection and includes hidden-recipient and injected-header content.
High
Open Relay Abuse Workflow
The skill gives manual and tool-based steps for testing external relay acceptance and documents exploitation potential.
The relay sections show external recipient tests and describe accepted relay traffic as vulnerable, with practical steps to reproduce it.
Low
System reconnaissance
- Target SMTP server IP/hostname
The cited line contributes to target or environment reconnaissance for SMTP assessment. It is low severity by itself but part of the broader operational workflow.
Low
System reconnaissance
- Some servers respond identically for valid/invalid users
The cited line contributes to target or environment reconnaissance for SMTP assessment. It is low severity by itself but part of the broader operational workflow.
Low
Network reconnaissance
### Required Access
The required access section asks for a target SMTP IP or hostname, which is necessary for active network reconnaissance. The line is contextual but real within the testing workflow.
Capability review items (76)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Critical
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Critical
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Critical
Ruby/shell backtick execution
| Metasploit | `use auxiliary/scanner/smtp/smtp_enum` |
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Critical
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
| smtp-user-enum | `smtp-user-enum -M VRFY -U users.txt -t IP` |
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
| Nmap | `nmap --script smtp-enum-users -p 25 IP` |
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
Ruby/shell backtick execution
```
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
High
sudo privilege escalation
sudo apt-get install nmap
The skill instructs users to run sudo apt-get install for Nmap network scanner. Requiring elevated package installation for offensive SMTP tooling creates a real host and misuse risk.
High
sudo privilege escalation
sudo apt-get install netcat
The skill instructs users to run sudo apt-get install for Netcat network utility. Requiring elevated package installation for offensive SMTP tooling creates a real host and misuse risk.
High
sudo privilege escalation
sudo apt-get install hydra
The skill instructs users to run sudo apt-get install for Hydra credential attack tool. Requiring elevated package installation for offensive SMTP tooling creates a real host and misuse risk.
High
sudo privilege escalation
sudo apt-get install smtp-user-enum
The skill instructs users to run sudo apt-get install for SMTP user enumeration tool. Requiring elevated package installation for offensive SMTP tooling creates a real host and misuse risk.
High
Email sending capability
# Using smtp-user-enum with VRFY
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M VRFY -U /usr/share/wordlists/users.txt -t TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M EXPN -U /usr/share/wordlists/users.txt -t TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M RCPT -U /usr/share/wordlists/users.txt -t TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M VRFY -U users.txt -t TARGET_IP -p 25 -d target.com
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
use auxiliary/scanner/smtp/smtp_enum
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
# SMTP user enumeration script
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
nmap --script smtp-enum-users -p 25 TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
nmap --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} -p 25 TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
nmap -p 25 --script smtp-open-relay TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
use auxiliary/scanner/smtp/smtp_relay
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
Test for weak SMTP credentials:
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
hydra -l admin -P /usr/share/wordlists/rockyou.txt smtp://TARGET_IP
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
hydra -l admin -P passwords.txt -s 465 -S TARGET_IP smtp
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
hydra -L users.txt -P passwords.txt TARGET_IP smtp
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
hydra -l admin -P passwords.txt smtp://TARGET_IP -V
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
medusa -h TARGET_IP -u admin -P /path/to/passwords.txt -M smtp
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
use auxiliary/scanner/smtp/smtp_login
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
### Phase 8: SMTP Command Injection
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
| smtp-user-enum | `smtp-user-enum -M VRFY -U users.txt -t IP` |
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
| Nmap | `nmap --script smtp-enum-users -p 25 IP` |
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
| Metasploit | `use auxiliary/scanner/smtp/smtp_enum` |
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t mail.target.c
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
nmap -p 25 --script smtp-open-relay mail.target.com
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
hydra -l admin -P /usr/share/wordlists/fasttrack.txt smtp://mail.target.com
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M VRFY -U users.txt -t 192.168.1.100 -p 25
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
smtp-user-enum -M RCPT -U users.txt -t 192.168.1.100 -p 25 -d target.com
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
use auxiliary/scanner/smtp/smtp_enum
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
High
Email sending capability
nmap -p 25 --script smtp-open-relay --script-args smtp-open-relay.from=test@attacker.com,smtp-open-r
The cited line supports active SMTP enumeration, relay testing, authentication attacks, or offensive tooling. This can enable unauthorized mailbox discovery, spam relay abuse, or credential compromise.
Medium
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Medium
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Medium
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Medium
Ruby/shell backtick execution
```bash
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Medium
Ruby/shell backtick execution
| Netcat | `nc IP 25` then manual commands |
The Markdown block provides executable command guidance for SMTP scanning, enumeration, relay testing, or credential attacks. Even though the syntax trigger is a code fence, the operational external-command risk is real.
Medium
Email sending capability
description: This skill should be used when the user asks to "perform SMTP penetration testing", "en
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identi
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
# Nmap with SMTP scripts
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
# SMTP user enumeration tool
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
sudo apt-get install smtp-user-enum
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
- Target SMTP server IP/hostname
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
### Phase 2: SMTP Service Discovery
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
Identify SMTP servers and versions:
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
# Discover SMTP ports
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
# SMTP-specific scripts
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
nmap --script=smtp-* -p 25 TARGET_IP
The cited line introduces SMTP assessment tooling or capabilities that lead into active mail-server testing. The context makes the email security risk real.
Medium
Email sending capability
Retrieve SMTP server information:
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
# Manual SMTP commands
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
### Phase 4: SMTP Command Enumeration
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
Test available SMTP commands:
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
openssl s_client -connect TARGET_IP:25 -starttls smtp
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
### Example 1: Complete SMTP Assessment
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Medium
Email sending capability
openssl s_client -connect mail.target.com:25 -starttls smtp
The cited line supports active SMTP assessment context such as target selection, service discovery, or protocol testing. It is less direct but still part of an operational testing workflow.
Risk Factors
⚙️ External commands (50)
SKILL.md:18-33 SKILL.md:33-57 SKILL.md:57-63 SKILL.md:63-69 SKILL.md:69-83 SKILL.md:83-89 SKILL.md:89-105 SKILL.md:105-109 SKILL.md:109-115 SKILL.md:115-121 SKILL.md:121-138 SKILL.md:138-142 SKILL.md:142-157 SKILL.md:157-163 SKILL.md:163-175 SKILL.md:175-179 SKILL.md:179-185 SKILL.md:185-189 SKILL.md:189-195 SKILL.md:195-201 SKILL.md:201-217 SKILL.md:217-221 SKILL.md:221-225 SKILL.md:225-229 SKILL.md:229-238 SKILL.md:238-244 SKILL.md:244-256 SKILL.md:256-260 SKILL.md:260-262 SKILL.md:262-266 SKILL.md:266-273 SKILL.md:273-279 SKILL.md:279-290 SKILL.md:290-294 SKILL.md:294-303 SKILL.md:303-309 SKILL.md:309-318 SKILL.md:318-324 SKILL.md:324-331 SKILL.md:331-339 SKILL.md:339-340 SKILL.md:340-341 SKILL.md:341-342 SKILL.md:342-343 SKILL.md:343-344 SKILL.md:344-345 SKILL.md:345-346 SKILL.md:346-365 SKILL.md:365-366 SKILL.md:366-367
🌐 Network access (50)
SKILL.md:439 SKILL.md:442 SKILL.md:447 SKILL.md:452 SKILL.md:453 SKILL.md:454 SKILL.md:2 SKILL.md:3 SKILL.md:9 SKILL.md:13 SKILL.md:19 SKILL.md:28 SKILL.md:29 SKILL.md:36 SKILL.md:42 SKILL.md:48 SKILL.md:55 SKILL.md:60 SKILL.md:65 SKILL.md:67 SKILL.md:70 SKILL.md:76 SKILL.md:77 SKILL.md:87 SKILL.md:92 SKILL.md:96 SKILL.md:102 SKILL.md:111 SKILL.md:114 SKILL.md:117 SKILL.md:119 SKILL.md:164 SKILL.md:165 SKILL.md:168 SKILL.md:171 SKILL.md:174 SKILL.md:180 SKILL.md:190 SKILL.md:191 SKILL.md:194 SKILL.md:203 SKILL.md:222 SKILL.md:242 SKILL.md:246 SKILL.md:249 SKILL.md:252 SKILL.md:255 SKILL.md:261 SKILL.md:267 SKILL.md:275
Detected Patterns
Metasploit framework×8System reconnaissance×6Network reconnaissanceNetwork scanning tools×19
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-smtp-penetration-testing/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-smtp-penetration-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-smtp-penetration-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-smtp-penetration-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-smtp-penetration-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). smtp-penetration-testing security audit report (audit version 6) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-smtp-penetration-testing/audits/6BibTeX citation
@techreport{sickn33-sickn33-smtp-penetration-testing-2026,
author = {sickn33},
title = {smtp-penetration-testing security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-smtp-penetration-testing/audits/6},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "smtp-penetration-testing security audit report (audit version 6)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-smtp-penetration-testing/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-smtp-penetration-testing:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
87
Spec Compliance
What You Can Build
Audit mail server exposure
Review SMTP ports, banners, relay behavior, and authentication controls during an authorized assessment.
Harden enterprise email infrastructure
Translate SMTP test results into clear remediation steps for relays, enumeration, TLS, and authentication records.
Prepare a lab security exercise
Create a controlled SMTP testing plan for training without using real users or production mail servers.
Try These Prompts
Review basic SMTP scope
Review my authorized SMTP assessment scope for [domain]. Identify safe discovery steps and the evidence I should collect.
Interpret banner findings
Given these SMTP banners and response codes, summarize likely risks, false positives, and administrator follow-up questions.
Plan relay and enumeration checks
Create a bounded test plan for relay exposure and user enumeration on approved mail servers. Include stop conditions and evidence handling.
Write remediation report
Turn these authorized SMTP findings into an executive summary, technical impact, prioritized fixes, and validation steps.
Best Practices
- Test only systems you own or have written permission to assess.
- Use lab targets for brute force, spoofing, and relay exercises.
- Record evidence, stop conditions, and remediation owners before testing.
Avoid
- Do not use enumeration results to prepare phishing or spam campaigns.
- Do not brute force production accounts without explicit approval and safeguards.
- Do not send live relay traffic to third-party recipients.
Frequently Asked Questions
Does this skill require authorization?
Yes. SMTP testing can affect real services and users, so written authorization is required.
Can it test open relay exposure?
Yes. It describes relay checks, but those checks should use controlled recipients and approved systems.
Does it include brute force guidance?
Yes. It references authentication testing tools, which create high risk outside controlled assessments.
Can it help with defensive hardening?
Yes. It covers disabling enumeration, enforcing TLS, adding rate limits, and improving SPF, DKIM, and DMARC.
Does it run tools automatically?
No. The skill is instructional text, but it provides commands that a user could run separately.
Is it suitable for public marketplace publishing?
It needs strong review because it includes offensive workflows, exploit framework usage, and credential attack examples.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/smtp-penetration-testingRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
9 downloads · 130 views
File structure
📄 SKILL.md