Penetration Testing Mail Server with Email Spoofing – Exploiting Open Relay configured Public Mail Servers

0
Email spoofing

Email spoofing is the way of delivering forged emails to recipients.These methods are used by criminals to launch attacks like phishing or spams to provide persistent backdoors with legitimate behavior.

Publicly available email servers can be used for spoofing attack. If you have configured your mail server with OPEN RELAY, this dangerous email spoofing attack can be performed by attackers.

An open relay is an SMTP server configured in such a way that allows a third party to relay (send/receive email messages that are neither from nor for local users). Therefore, such servers are usually targeted by spam senders to send spoofed emails to victims inbox.

Searching the vulnerable mail server in public network with open relay configured might be the task to do this email spoofing.

Also Read Email Header Analysis – Received Email is Genuine or Spoofed

Discovery of Vulnerable Mailserver- Email spoofing

  • The attacker will be trying to find mail server with subdomain enumeration tools like Dig, Nslookup or else straightforward of using the legitimate website like VirusTotal to find the subdomains of your target.

Telnet or Netcat Client:

  • Many ISPs will block or restrict SMTP connections on port 25.Why blocking port 25?
  • According to  Internet Engineering Task Force (IETF).Request For Comments (RFC) 821 was published, establishing port 25 as the default transmission channel for internet email.We still use port 25 as the primary means of transmitting email between two mail servers.
  • Later RFC 2476 submitted in support of adding a new specification for internet email communications.The RFC proposed a split of the traditional message submission and message relay concept.
  • The RFC 2476 defined that message submission should occur over port 587 to ensure new policy and security requirements.
  • Finally, the RFC 2487 defined STARTTLS protocol which is Extension for Secure SMTP over TLS as encrypting communications over the internet.
  • To check this, we can use Telnet or Netcat client.
  • Above figure shows you’re on the external mail server.It should not connect.Here we should get an error.

SMTP Commands:

Whatever you do with Email such as Composing of mail, sending to the recipient, etc. every action will be performed with SMTP commands with Codes which is behind the scene.So understanding the SMTP commands is the better way to understand open mail relay.

  • HELO It’s the very first SMTP welcome command to start the conversation and identifying the sender server and is followed by its domain name.
  • EHLO Same like HELO command or An alternative command to start the conversation, underlying that the server is using the Extended SMTP protocol.
  • EMAIL FROM The sender states the source email address in the “From” field and starts the email transfer.
  • RCPT TO It identifies the recipient of the email
  • DATA Sending your body of mail by the DATA command the email content begins to be transferred.
  • VRFY The server is asked to verify whether a particular email address or username exists.
  • AUTH Authentication command, the client authenticates itself to the server, giving its username and password.
  • HELP client’s request for some information that can be useful for the successful transfer of the email.
  • EXPN asks for confirmation about the identification of a mailing list.
  • RSET Client communicates the server to stop the ongoing email transmission or terminating the continuous mail from the server.
  • ETRN or TURN changes roles between the client and the server.Client will be acting as SMTP Server
  • QUIT It terminates the SMTP conversation.

Mailserver User Enumeration

  • Attacker finds out the present mail addresses in the server with VRFY SMTP Command.
  • Above figure shows mail server replies with 250 code that tells us the usernames are found on the mail server.

Composing the spoofing mail

  • Here we have enumerated two usernames in the mail server.
  • Above figure shows SMTP Commands MAIL FROM and RCPT TO are utilized to send the forged mail to the receiver.
  • Syntax for sender:      mail from:[email protected]
  • Syntax for receiver:    rcpt to:[email protected]
  • Mailserver will reply with 250 code as sender and receiver are ok!

Sending Forge mail

  • Now its final step to use this open relay to send spoofed emails to receivers.
  • Utilize SMTP command DATA to compose the mail in the command line.
  • executing DATA command will receive a 354 code to compose our mail to target.
  • Above figure shows mail is forged from to subject: with the body of mail with some message to the receiver.
  • Enter . after composing the mail on the new line and hit enter to fire the spoofed mail to target.
  • Now the spoofed mail is sent to the receiver.

Never configure your mail server with the open relay.Implement security controls with authentication with user accounts and encryption with STARTTLS.Configure email gateway allow only authorized IP addresses to send.Happy Hacking !!!

Disclaimer

This article is only for an Educational purpose. Any actions and or activities related to the material contained on this Website is solely your responsibility.The misuse of the information on this website can result in criminal charges brought against the persons in question. The authors and www.gbhackers.com  will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.

Leave a Reply

Situs Togel 4D Bo Togel Bandar Togel Deposit Pulsa Agen Togel Deposit Ovo Togel Bet 100 Perak Bandar Togel Terbesar Toto Togel Bandar Togel Daftar Bandar Togel Terbesar agen togel deposit ovo situs togel 4d Slot Bonus 100 Situs Judi Slot Terbaik Slot Gacor Slot Pragmatic Link Slot Gacor Dingdong Togel Slot Deposit Pulsa Situs Slot Judi Online Agen Slot Online BO Togel 5 Bandar Togel Terpercaya Agen Togel Bet 100 Perak Toto Togel Agen Togel Resmi Bandar Togel Deposit Pulsa Dingdong Togel Situs Togel Terbesar Bandar Darat Togel Togel Toto Online Togel Singapore BO Togel Bet 100 Perak Agen Togel Deposit Pulsa Situs Bandar Togel Hadiah 4D 10 Juta 10 Situs Togel Terpercaya 5 Bandar Togel Terpercaya Situs Slot Deposit Pulsa Agen Slot Online Togel Hari Akun Slot Bet Game Situs Judi Slot Situs Judi Slot Resmi Game Slot Slot Game Bonus New Member 100 Agen Togel terpercaya 10 Situs Togel Terpercaya Agen Togel Online Agen Togel Singapore Togel Toto Macau Situs Togel Terpercaya 10 Situs Togel Terpercaya Situs Bandar Judi Togel Situs Togel BRI Online 24 Jam situs togel dan slot SITUS TOGEL DEPOSIT VIA DANA situs togel terbaik 5 bandar togel terpercaya bandar togel hadiah 4d 10 juta terpercaya BANDAR TOGEL HADIAH 4D 10 JUTA Situs Slot Bet 100 Perak situs bandar togel terpercaya Bandar Togel Deposit Pulsa Situs Slot Situs Slot deposit Pulsa Agen Slot Dan Togel Toto Slot Bandar Togel Hadiah 4D 10 Juta Situs Togel Online Situs Slot Togel Terlengkap Agen Slot BO Togel Agen Togel Online Situs Bandar Togel Dan Slot Situs Togel Togel Deposit Pulsa Slot Gacor Bandar Togel Lengkap Situs Slot 5 Bandar Togel Terpercaya Bo Togel dan Slot Toto Togel Judi togel Togel Hadiah 2D 100rb Bandar Togel Dan Slot Togel Bet 100 Lotre Togel bandar darat togel 5 bandar togel terpercaya Situs Togel Terpercaya bandar judi terpercaya Bandar Togel Terbesar Bandar Togel Online bandar togel bandar togel terpercaya hadiah terbesar judi togel bandar togel terbesar situs judi online bandar togel terbesar Togel Online Bandar Togel Bolak Balik Dibayar Bandar Togel Lengkap situs togel Bandar Togel Togel Hadiah 4d Terbesar bandar togel hadiah terbesar Bandar Togel Hadiah 4d Terbesar judi togel Togel Online Terbaik Situs Togel Terbesar Bandar Lotre Togel Togel Kamboja Dingdong Togel Bandar Togel Terbesar dan Terpercaya Bandar Togel Terpercaya Daftar Bandar Togel Togel Deposit Via Dana 5 Bandar togel terpercaya agen togel terpercaya slot online Situs Bonus New Member Slot Gacor 10 Situs Bandar Togel Slot Online Agen Slot Online Slot Pragmatic Slot Pragmatic Agen Togel Lengkap Bandar Togel Hadiah 4d 10 Juta Slot Resmi Bo Togel Situs Togel Terpercaya 5 Bandar Togel Terpercaya Agen Bo Togel Bandar Togel Slot Pragmatic Judi Slot Pragmatic agen togel online Agen Togel Terpercaya toto togel 5 Bandar Togel Terpercaya Bandar Togel Terpercaya Bandar Togel Online Situs Togel Resmi Agen Slot Judi Slot Online 10 Situs Togel Terpercaya Slot Pulsa Tanpa Potongan Situs Slot Gacor Bo Togel Togel deposit pulsa Agen Judi Slot Online Terpercaya Situs Slot Gacor Mesin Slot Bandar Togel dan Slot Agen Judi Slot Pragmatic Slot Online Via Dana Link Slot Gacor Situs Game Slot Online SITUS SLOT ONLINE GAME SLOT Agen Togel Terpercaya Bandar Togel Slot Bandar Togel dan Slot Bandar Togel Terpercaya Hadiah 4d 10 Juta Bo Togel Bandar Togel Deposit Pulsa Bandar Togel Terpercaya Bandar Togel Hadiah 2d 100rb Slot Pragmatic 5 Bandar Togel Terpercaya Bandar Darat Togel Bandar Togel Dan Slot Bandar Togel Hadiah 2d 100rb Bandar Togel Hadiah Terbesar Bandar Togel Lengkap Bandar Togel Online Bandar Togel Terbesar Daftar Bandar Togel Tertua Agen Slot Bonus 100 Agen Togel Mesin Slot BANDAR TOGEL HADIAH 2D 100RB Bandar Togel 77 TOTO SLOT 5 Bandar Togel Terpercaya 5 Bandar Togel Terpercaya 2022 Situs Judi Slot Terbaik Bandar Darat Togel Bandar Lotre Togel Bandar Togel Bet 100 Rupiah Bandar Togel Bet 100 Bandar Togel Hadiah 4d 10 Juta Terpercaya BANDAR TOGEL HADIAH 4D 10 JUTA Bandar Togel Terpercaya BANDAR TOGEL TERPERCAYA HADIAH TERBESAR Bandar Togel Terbesar BANDAR TOGEL LENGKAP Bandar Togel Hadiah Full Togel Online Bandar Togel Resmi Bandar Togel Terbaik Bandar Togel Terbesar Situs Slot Online Bandar Judi Slot Online BANDAR JUDI SLOT ONLINE BANDAR TOGEL TERPERCAYA KUMPULAN SITUS JUDI SLOT 4D Situs Bandar Togel Hadiah 4d 10 Juta LINK BANDAR SLOT TERPERCAYA Daftar Bandar Togel Terbesar Dan Terpercaya Daftar Bandar Togel Tertua Dingdong Togel Daftar Situs Judi Slot Online BANDAR TOGEL TERPERCAYA AGEN JUDI SLOT ONLINE TERPERCAYA DAFTAR JUDI SLOT ONLINE Slot Pragmatic BO JUDI SLOT ONLINE DAFTAR SITUS SLOT GACOR Nama Nama Situs Judi Slot Online Terpercaya Togel China Bandar Judi Slot Online SITUS JUDI SLOT DEPOSIT PULSA Situs Slot Deposit Pulsa Togel Kamboja Agen Togel Resmi AGEN SLOT ONLINE Slot Bonus New Member 100 LINK BO TERPERCAYA SITUS SLOT GACOR Slot Gacor Agen Judi Slot Online Resmi DAFTAR NAMA NAMA SITUS JUDI SLOT ONLINE DAFTAR SITUS JUDI SLOT ONLINE AGEN TOGEL RESMI DEPOSIT PULSA Toto Slot Agen Judi Slot Gacor SLOT ONLINE KUMPULAN NAMA SITUS SLOT ONLINE TERPERCAYA Bandar Togel dan Slot GAME SLOT ONLINE Togel Bandar Darat BANDAR TOGEL TERBESAR TOGEL HADIAH PRIZE 123 BANDAR TOGEL TERPERCAYA Agen Slot Online Situs Slot Deposit Pulsa Situs Judi Online Situs Slot Online Situs Judi Togel Situs Judi Slot Online Terpercaya 5 Bandar Togel Terpercaya Toto Slot Agen Judi Slot Online Situs Slot Terbaru Togel Deposit Pulsa Slot Online Situs Judi Slot Online Terpercaya Slot Pragmatic Bandar Togel Bet 100 Perak Situs Slot Slot Deposit Pulsa Slot Mpo Situs Judi Slot Online Slot Online Terbaik dan Terpercaya Game Slot Agen Slot Pulsa Slot Gacor Agen slot dan Togel Agen Judi Slot Online Terpercaya Togel dan Slot Agen Togel Slot Gacor Slot Gacor Agen Judi Slot Online24Jam Slot Gacor Judi Online Judi Slot Online Bo Togel Slot Online Sultanplay Situs Judi Slot Online Situs Mpo Slot Gacor Slot PG Soft Slot Online Sultanplay Situs Togel Online Agen Judi Slot Online Situs Togel dan Slot Online 10 Situs Togel Terpercaya 10 SITUS TOGEL TERPERCAYA Slot Online Terpercaya Joker Slot Bandar Togel Dan Slot Bandar Togel Hadiah Full Bandar Togel Hadiah Terbesar Bandar Togel BANDAR TOGEL TERPERCAYA Akun Togel Resmi Togel Macau Togel Kamboja Slot Deposit 5000 Slot Terpercaya Togel Singapura Toto Macau Nama Nama Situs Slot Online Bandar Togel Kamboja Bandar Togel Terpercaya Togel Hadiah 4d 10 Juta Terpercaya Agen Slot Agen Judi togel Resmi Situs Togel Terpercaya Situs Togel Terbesar Bandar Toto Terpercaya Agen Slot Gacor Togel Hongkong Judi Slot Online Hondatoto Ojktoto