312-50 Question 99
Select 2▪ SMTP and DNS EnumerationDuring an authorized external assessment of examplecorp.com, you are asked to identify publicly exposed email infrastructure and determine whether the organization's mail server can be used for username enumeration without sending actual email. Which TWO actions are the most appropriate to achieve this goal?
- A
Query the domain's MX records with a DNS lookup to identify the mail exchanger hosts, then connect to the SMTP service and test recipient validation using commands such as VRFY or RCPT TO.
- B
Perform a DNS zone transfer (AXFR) against the target's name servers and assume that if it fails, SMTP user enumeration is not possible.
- C
Use an SNMP walk against UDP 161 on the mail server to retrieve the list of valid mailbox users.
- D
Connect to TCP 25 or 587 on the discovered mail host, issue EHLO/HELO, and observe whether the server accepts or rejects RCPT TO for likely usernames before message data is sent.
- E
Send crafted phishing emails with tracking links to likely addresses and treat opens as proof that the mailbox exists.
Show answer and explanation
Correct answers: A, D
Explanation
The best answer combines DNS enumeration with SMTP enumeration. First, query MX records to identify the domain's inbound mail servers. This is a standard DNS reconnaissance step and can be performed with tools such as dig, nslookup, or host. Then, test the SMTP service directly on the discovered host. Historically, SMTP commands like VRFY and EXPN were intended to verify users or expand mailing lists, but many modern MTAs disable them for security reasons. As a result, assessors often look for recipient-validation behavior by issuing RCPT TO for candidate usernames after EHLO or HELO and checking whether the server returns different SMTP status codes, such as 250 for accepted recipients or 550/551/553 for invalid ones. This aligns with SMTP behavior defined in RFC 5321 and common hardening guidance, which recommends restricting VRFY/EXPN and avoiding information leakage through recipient validation where possible. DNS zone transfer testing may still be worthwhile during reconnaissance, but AXFR is a separate misconfiguration check and not a prerequisite for SMTP user enumeration.
- A. Correct.
Correct. Looking up MX records is the standard way to identify the hosts responsible for receiving email for a domain. After identifying the mail exchanger, an assessor can connect to the SMTP service and test whether the server exposes user-validation behavior through SMTP commands. Historically, commands such as VRFY and EXPN were used for this purpose, though many modern servers disable them. In practice, some servers still leak account validity through differences in responses to RCPT TO during the SMTP conversation before any message body is transmitted.
- B. Incorrect.
Incorrect. Attempting a DNS zone transfer can sometimes reveal hostnames and email-related infrastructure if a name server is misconfigured, but it is not required for SMTP enumeration and its failure does not imply that SMTP user enumeration is impossible. SMTP enumeration and DNS enumeration are related but separate activities. A failed AXFR only indicates that full zone transfer is not permitted, which is the expected secure configuration for most organizations.
- C. Incorrect.
Incorrect. SNMP may expose useful system information if misconfigured, but it is not a standard or reliable method for enumerating mailbox users on an SMTP server. Many mail servers do not expose mailbox data through SNMP at all, and relying on SNMP here reflects a misunderstanding of how email user enumeration is typically performed in CEH-style scenarios.
- D. Correct.
Correct. This is a practical and commonly tested technique. After identifying the mail host, connecting to SMTP and issuing EHLO or HELO establishes the session. Some servers reveal whether a recipient exists by returning different status codes to RCPT TO for valid versus invalid local parts before the DATA phase. This allows username enumeration without sending a full email message. It is more realistic than depending solely on VRFY, which is often disabled.
- E. Incorrect.
Incorrect. Sending phishing emails to test mailbox existence is not an appropriate enumeration technique in this context because it goes beyond passive or minimally invasive service enumeration and introduces unnecessary risk and impact. The scenario specifically asks for a method that does not require sending actual email. Opens are also unreliable because many clients block remote content or route messages through security tools.