Agent skill · security · aiskillstore
smtp-penetration-testing
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
Why this skill is useful
Provides specific techniques and commands for conducting SMTP penetration testing that the AI wouldn't reliably generate on its own.
What it needs
Requires hydra, netcat, nmap, smtp-user-enum installed locally. About 7k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
SMTP Penetration Testing Purpose Conduct comprehensive security assessments of SMTP (Simple Mail Transfer Protocol) servers to identify vulnerabilities including open relays, user enumeration, weak authentication, and misconfiguration. This skill covers banner grabbing, user enumeration techniques, relay testing, brute force attacks, and security hardening recommendations. Prerequisites Required Tools Required Knowledge SMTP protocol fundamentals Email architecture (MTA, MDA, MUA) DNS and MX records Network protocols Required Access Target SMTP server IP/hostname Written authorization for testing Wordlists for enumeration and brute force Outputs and Deliverables 1. SMTP Security Assessment Report - Comprehensive vulnerability findings 2. User Enumeration Results - Valid email addresses discovered 3. Relay Test Results - Open relay status and exploitation potential 4. Remediation Recommendations - Security hardening guidance Core Workflow Phase 1: SMTP Architecture Understanding Phase 2: SMTP Service Discovery Identify SMTP servers and versions: Phase 3: Banner Grabbing Retrieve SMTP server information: Parse banner information: Phase 4: SMTP Command Enumeration Test available SMTP commands: Key commands to test: Phase 5: User Enumeration Enumerate valid email addresses: Using Metasploit: Using Nmap: Phase 6: Open Relay Testing Test for unauthorized email relay: Using Metasploit: Test variations: Phase 7: Brute Force Authentication Test for weak SMTP credentials: Using Medusa: Using Metasploit: Phase 8: SMTP Command Injection Test for command injection vulnerabilities: Email spoofing test: Phase 9: TLS/SSL Security Testing Test encryption configuration: Phase 10: SPF, DKIM, DMARC Analysis Check email authentication records: Quick Reference Essential SMTP Commands Command Purpose Example --------- --------- --------- HELO Identify client HELO client.com EHLO Extended HELO EHLO client.com MAIL FROM Set sender MAIL FROM:<sender@test.com> RCPT TO Set recipient RCPT TO:<u …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/smtp-penetration-testing