3

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more information about the targets like: hostnames, IP-addresses, software and software versions.

I thought about trying to fill in some forms that contain an email field in order to possibly trigger an outgoing mail-event. But I want it to be more low profile. Since such mail-event will trigger and internal (mail) event as well.

Also I thought about sending an email to a non-existing email address in order to get it bounced back. But that won't work when they use a catch-all policy.

In other words: Can I trigger or force an mailserver to send an email to a desired mail address, owned by me?

|improve this question
  • I haven't tried, but I could imagine that most mailservers will reply with an error mail even when catch-all is configured when the recipient is not just unknown but actually syntactically incorrect. – Philipp Jul 6 '16 at 14:24
  • 2
    By the way: filling a mail form to trigger a mail event is not conspicious at all. Such forms get spammed by bots all the time. – Philipp Jul 6 '16 at 14:25
4

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups.

The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized users to send mail to external sites.

If this does not work you might try to generate a delivery error upstream which results in a bounce to you. How such delivery errors can be generated again depends on the setup of the infrastructure, but you might try to send mails with a virus inside (like EICAR test virus), with invalid MIME structure, invalid DKIM signature or similar problems in the hope that some firewall will croak about such mail and cause a bounce.

|improve this answer
0

If you're just looking for header info you can try the SMTP server test on wormly.com. It tries to use the target mail server as a relay for a message. It will probably fail if relaying is disabled, but there may be some information disclosure that may help.

Additional sources and methods for gathering information regarding email servers are:

Passive

Active

  • Port scan with nmap specifically -sV for banner grabbing in an effort to ID services,
  • MXToolbox for querying information about the DNS records, etc,
  • For Social Engineering (SE), register a dummy email address and fill out the online form, or contact a representative directly (ID their email address from LinkedIN or theHarvester) and request some bogus information.
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.