Comprehensive SMTP & Postfix Pentesting Guide

This guide outlines steps to assess the security of an SMTP server, with a particular focus on Postfix, covering initial connection, capability discovery, encryption, authentication, and relay testing.

Target Example: <target_domain> (e.g., mail.example.com) or <target_ip>

Phase 1: Initial Discovery & Banner Grabbing

Objective: Identify if the port is open, what service is running, and gather initial banners.

1. Basic Port Scan (Nmap):

   • Command: nmap -p 25,587,465 -sV <target_ip_or_domain>
   • Purpose: Check standard SMTP ports (25: SMTP, 587: Submission, 465: SMTPS). -sV attempts version detection.
   • Example Output (Port 587): PORT 587/tcp open smtp Postfix smtpd (or other server software like Exim, Microsoft ESMTP Server, etc.)

2. Telnet Connection (Manual Interaction):

   • Command: telnet <target_ip_or_domain> <port> (e.g., telnet mail.example.com 587)
   • Purpose: Establish a raw connection to observe the server's greeting banner.
   • Example Output: 220 mail.example.com ESMTP Postfix (or similar, indicating service readiness and server name/software).

Phase 2: Capability Enumeration (EHLO/HELO)

Objective: Discover supported SMTP commands and extensions.

1. Send EHLO (Extended Hello):
   • Telnet Command (after connection): EHLO client.example.com (use a descriptive name for your testing client)
   • Purpose: Client introduces itself and server lists supported ESMTP keywords.
   • Keywords to Look For:
     • STARTTLS: Indicates support for opportunistic TLS encryption.
     • AUTH <mechanisms>: Lists supported authentication types (e.g., LOGIN, PLAIN, CRAM-MD5).
     • SIZE: Maximum message size.
     • PIPELINING, 8BITMIME, ENHANCEDSTATUSCODES, etc.
   • Example Output (Port 587): 250-mail.example.com 250-PIPELINING 250-SIZE 50000000 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 CHUNKING
     • Observation: Note which capabilities are present or absent. STARTTLS and AUTH are critical for secure operation on port 587.

Phase 3: Testing TLS/SSL Encryption (STARTTLS & SMTPS)

Objective: Verify if secure communication is supported and properly configured.

1. Attempt STARTTLS (if advertised or suspected on Port 587/25):

   • Telnet Command (after EHLO): STARTTLS
   • Purpose: Request to upgrade the plain text connection to TLS.
   • Expected Success Response: 220 Ready to start TLS (or similar).
   • If STARTTLS is not advertised: Attempting it might result in an error like 500 Command not recognized.

2. Direct TLS/SSL Connection Test (openssl s_client):

   • For STARTTLS (Ports 25, 587): openssl s_client -connect <target_ip_or_domain>:<port> -starttls smtp
   • For SMTPS (Port 465 - implicit TLS): openssl s_client -connect <target_ip_or_domain>:465
   • Purpose: Establish a TLS connection, view certificate details, and check supported protocols/ciphers.
   • Example Output if STARTTLS fails or is not supported on port 587: Didn't find STARTTLS in server response, trying anyway... ...error: [specific SSL/TLS error, e.g., wrong version number]... no peer certificate available
     • Observation: Failures here indicate issues with STARTTLS negotiation.

3. Nmap SSL/TLS Scripting:

   • Command: nmap -p <port> --script="ssl-cert,ssl-enum-ciphers" <target_ip_or_domain>
   • Purpose: Get certificate details and list supported cipher suites.
   • Observation: If STARTTLS is not offered or not working on a port, these scripts might not return SSL-specific information for that port. If port 465 (SMTPS) is scanned, it should directly return SSL info if open.

Phase 4: Authentication Testing

Objective: Determine if authentication is required and if it's handled securely.

1. Check for AUTH in EHLO Response:

   • As noted in Phase 2. If AUTH mechanisms are listed before STARTTLS, it's a potential cleartext auth vulnerability. AUTH should ideally only be advertised after STARTTLS is successfully negotiated.

2. Attempt AUTH Commands (Telnet / openssl s_client):

   • If STARTTLS is working: Perform these after STARTTLS using openssl s_client (and a new EHLO within the TLS session).
   • If STARTTLS is NOT working/advertised: Test cautiously in telnet to see if cleartext auth is offered.
     • AUTH LOGIN
       • Expected prompt if offered: 334 VXNlcm5hbWU6 (Base64 for "Username:")
     • AUTH PLAIN
       • Expected prompt if offered: 334 (empty, awaiting Base64 \0user\0pass)
   • Example Output if cleartext AUTH is disabled (good) or if AUTH is not supported before STARTTLS (also good if STARTTLS works):
     • AUTH LOGIN -> 503 5.5.1 Error: authentication not enabled or 504 Unrecognized authentication type or 530 5.7.0 Authentication required (if STARTTLS was expected first).
     • Observation: If the server prompts for credentials without STARTTLS, it's a vulnerability.

Phase 5: Relay Testing

Objective: Determine if the server allows relaying mail to external domains, especially without authentication (Open Relay).

1. Sequence of Commands (Telnet / openssl s_client):

   • EHLO client.example.com (Wait for 250 Ok)
   • MAIL FROM:<test@yourlocaldomain.com> (Use a test address)
     • Example Output: 250 2.1.0 Ok (Sender accepted)
   • RCPT TO:<user@externaldomain.com> (Use an external recipient)
     • Example Output if relaying is denied (good): 550 5.7.1 <user@externaldomain.com>: Relay access denied or 554 5.7.1 ... Recipient address rejected: Access denied
     • Observation: If the server returns 250 Ok for an external recipient without authentication, it's an open relay.

2. Session Reset (RSET):

   • Telnet Command: RSET
   • Purpose: Abort the current mail transaction and reset the server state if commands get out of sync.
   • Expected Response: 250 Ok

Phase 6: Comprehensive Nmap Scan (Example for a specific port)

Objective: Combine various Nmap scripts for a fuller picture if initial probes are inconclusive.

1. Example Nmap Command (Port 587): bash nmap -p 587 --script 'banner,smtp-commands,smtp-enum-users,smtp-ntlm-info,smtp-vuln*,ssl-cert,ssl-enum-ciphers,tls-nextprotoneg' -sV -T4 -Pn <target_ip_or_domain>
   • Note: Ensure script names with * are quoted in shells like zsh to prevent globbing.
   • Purpose: Runs a battery of scripts for banner, SMTP commands, user enumeration attempts, NTLM info (if applicable), known SMTP vulnerabilities, and SSL/TLS details. -T4 for faster execution, -Pn to skip host discovery if the host is known to be up but might block pings.
   • Example Key Points from Output:
     • Confirm server software (e.g., Postfix, Exim).
     • List EHLO capabilities. STARTTLS or AUTH might be detected here by Nmap even if missed in manual EHLO.
     • Results from smtp-enum-users (often inconclusive on hardened servers).
     • SSL/TLS script output if STARTTLS is detected and working.

Key Takeaways & Reporting Examples:

• Misconfiguration Example 1: No STARTTLS on Submission Port: Port 587, intended for secure client submission, does not offer STARTTLS. If it also accepts AUTH in cleartext, this is critical. If it disables AUTH without STARTTLS but also denies relay, it may be misconfigured or unusable for standard clients.
• Misconfiguration Example 2: Cleartext Authentication: Server offers AUTH LOGIN or AUTH PLAIN before STARTTLS negotiation on any port, exposing credentials.
• Vulnerability Example: Open Relay: Server accepts RCPT TO: for external domains without prior authentication.
• Good Practice Confirmation: Server correctly requires STARTTLS before AUTH on port 587, and port 465 (SMTPS) is available as an alternative.
• Reportable Issue Structure: Title (e.g., "SMTP Server Accepts Authentication Credentials in Cleartext", "SMTP Server Misconfigured: STARTTLS Not Offered on Submission Port"), Description of Findings, Commands Used, Impact, Remediation Advice.

This guide should provide a solid foundation for SMTP and Postfix pentesting. Remember to adapt commands and interpretations based on the server's specific responses and behavior. Always test responsibly and with proper authorization.