Can I trick a mail server into sending me an email?

Question

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more information about the targets like: hostnames, IP-addresses, software and software versions.

I thought about trying to fill in some forms that contain an email field in order to possibly trigger an outgoing mail-event. But I want it to be more low profile. Since such mail-event will trigger and internal (mail) event as well.

Also I thought about sending an email to a non-existing email address in order to get it bounced back. But that won't work when they use a catch-all policy.

In other words: Can I trigger or force an mailserver to send an email to a desired mail address, owned by me?

Answer 1

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups.

The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized users to send mail to external sites.

If this does not work you might try to generate a delivery error upstream which results in a bounce to you. How such delivery errors can be generated again depends on the setup of the infrastructure, but you might try to send mails with a virus inside (like EICAR test virus), with invalid MIME structure, invalid DKIM signature or similar problems in the hope that some firewall will croak about such mail and cause a bounce.

Answer 2

If you're just looking for header info you can try the SMTP server test on wormly.com. It tries to use the target mail server as a relay for a message. It will probably fail if relaying is disabled, but there may be some information disclosure that may help.

Additional sources and methods for gathering information regarding email servers are:

Passive

• Shodan
• Netcraft

Active

• Port scan with nmap specifically -sV for banner grabbing in an effort to ID services,
• MXToolbox for querying information about the DNS records, etc,
• For Social Engineering (SE), register a dummy email address and fill out the online form, or contact a representative directly (ID their email address from LinkedIN or theHarvester) and request some bogus information.