During an internal test you connect to the company SMTP service on port 25. A "VRFY jsmith" probe returns:
252 2.0.0 Cannot VRFY user, but will accept message and attempt delivery
Which other SMTP command can you issue to keep enumerating users, since it often remains enabled and replies 250 for valid recipients and 550 for invalid ones?
Because mail servers must still process normal delivery, the RCPT TO command is usually accepted even when VRFY and EXPN are disabled. After a MAIL FROM line, sending RCPT TO:[email protected] elicits 250 (recipient exists) or 550 (no such user), allowing enumeration. HELO only identifies the client, DATA starts the message body, and RSET aborts the transaction without revealing user validity.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does the RCPT TO command do in SMTP?
Open an interactive chat with Bash
Why are VRFY and EXPN often disabled on mail servers?
Open an interactive chat with Bash
What is the significance of SMTP port 25 in internal testing?
Open an interactive chat with Bash
Certified Ethical Hacker (CEH)
Reconnaissance Techniques
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99
$19.99/mo
Billed monthly, Cancel any time.
3 Month Pass
$44.99
$14.99/mo
One time purchase of $44.99, Does not auto-renew.
MOST POPULAR
Annual Pass
$119.99
$9.99/mo
One time purchase of $119.99, Does not auto-renew.
BEST DEAL
Lifetime Pass
$189.99
One time purchase, Good for life.
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .