> For the complete documentation index, see [llms.txt](https://oscp.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oscp.adot8.com/services/smtp-less-than-tcp-25-greater-than.md).

# SMTP \<tcp 25>

```
nmap -p25 --script=smtp* 192.168.160.136 -v
```

```
telnet 192.168.160.136 25
VRFY root
EXPN root
```

```python
smtp-user-enum -U users.lower -t postfish.off
```

{% hint style="info" %}
Usernames can be based of names and or departments
{% endhint %}