Hello, everyone.
In this video we are going to see and map mail
exploitation.
So
the first one that we are going to see is the nmap open
relay scan.
The syntax of doing this scan is nmap. The target IP address
followed by -script equals to
SMTP - open hyphen relay
and
the port number that you can specify followed by
hyphen V to see the output in verbose mode.
So you can scan a Target by simply giving IP address
and specifying the SMTP hyphen open hyphen relay
flag. So what does actually happens?
The SMTP server that works as an open relay is
an email server that does not verify if
the user is authorized to send email from the specified email
address. Therefore users would
be able to send emails originating from any third
party email address that they want.
Which makes the server vulnerable?
The example of doing this scan is given over here
and let's see.
This in Practical how we can identify if
any server is vulnerable to open relay?
As we can see here.
This is the command that we are going to type. So I will
just copy this and go to the terminal.
As you can see I have already performed this particular
scan and this is the output.
I have not set it up any SMTP open
relay server into my system. That's
why you can see Server doesn't seem to be an
open relay all test failed. But if in server
is vulnerable to open relay, it will show you
that this seems vulnerable to open relay
and can be exploited.
I have also performed this particular scan on
one more website, which is hacker1.com to
identify if they are running on an open relay
and you can see they have filtered their port
and we are not able to scan that Port itself.
But you can always try this on many other live
websites and you will be able to find out if any
SMTP is an open relay
and you can exploit it.
I hope you guys understood. Thank you.