• 👉 Overview
• 👀 What ?
• 🧐 Why ?
• ⛏️ How ?
• ⏳ When ?
• ⚙️ Exploitation
• Manual
• 🖇️ Références

👉 Overview

👀 What ?

SMTP Banner Grabbing is a specific instance of the broader concept known as banner grabbing, which is a technique used to gain information about a computer system on a network and the services running on its open ports. In the case of SMTP (Simple Mail Transfer Protocol), which is the primary method used to send email over the internet, a banner can reveal crucial details about the SMTP server including its software version and sometimes even the operating system of the host. Banner grabbing can be likened to a conversation where the banner is the initial greeting that the server gives when it first communicates with another entity. This information can be used by system administrators to take an inventory of the systems and services on their network. However, an intruder can also use banner grabbing to find network hosts that are running versions of applications and operating systems with known exploits

🧐 Why ?

The importance of understanding SMTP Banner Grabbing lies in its potential for exploitation. It’s a double-edged sword that serves beneficial purposes for administrators but can also provide malicious actors with the information they need to exploit system vulnerabilities.

⛏️ How ?

Banner grabbing can be seen when a connection is initiated to an SMTP server using a tool like Netcat. The response will typically contain information about the service running on the host.

⏳ When ?

The history of SMTP Banner Grabbing is somewhat difficult to pin down to a specific start date as it likely began to be used as soon as systems began to give out information in their banners.

⚙️ Exploitation

Manual

You can initiate a connection to the SMTP service with Netcat :

nc -vn <IP> 25

With telnet :

telnet <IP> 25

For SMTPS you can initiate a connection with openssl :

openssl s_client -crlf -connect smtp.example.net:465 #SSL/TLS without starttls option
openssl s_client -starttls smtp -crlf -connect smtp.example.net:587

🖇️ Références

• https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp#basic-actions