Question

During an external assessment, a penetration tester connects to a target's mail server on TCP port 25 and manually issues SMTP commands. The tester wants to confirm whether specific usernames exist as valid local mailboxes without sending any messages. Which SMTP command sequence is MOST appropriate for enumerating valid user accounts?

Accepted Answer

Issue VRFY <username> and observe whether the server returns a 250/252 (valid) versus a 550 (unknown user) response

Answer

Issue DATA followed by the message body and check for a 354 response to confirm the mailbox

Answer

Issue STARTTLS and inspect the certificate common name for embedded account names

Answer

Issue HELO followed by QUIT and parse the 221 closing banner for a user list