# smtp-penetration-testing

A Claude skill that walks the agent through SMTP checks: banner grabbing, user enumeration, open relay tests, credential brute force.

- skill · `type=skill` · Claude Code · 113 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/smtp-penetration-testing
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/smtp-penetration-testing

## What it does

The skill splits SMTP work into ten phases. The agent starts with architecture and ports, discovers the service with `nmap`, reads the banner, probes `VRFY`, `EXPN` and `RCPT TO`, tests for an open relay, tries credentials, then inspects TLS. Header injection and SPF, DKIM, DMARC lookups get their own phases.

Each step ships with commands to run: `nmap --script smtp-*`, `smtp-user-enum`, `hydra`, `medusa`, Metasploit modules, and `openssl s_client` with `-starttls smtp`. Deliverables are a findings report, the list of addresses that turned out valid, relay status, and hardening notes.

Skip the tool install and half the phases go nowhere — `nmap`, `netcat`, `hydra`, `smtp-user-enum` and Metasploit have to be on the box. You also need a target, wordlists, and written authorization. Running this against a server you do not own or have a signed scope for is on you.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/smtp-penetration-testing
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill smtp-penetration-testing -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/smtp-penetration-testing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/smtp-penetration-testing/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/smtp-penetration-testing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/smtp-penetration-testing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates smtp-penetration-testing
```

2. **Manually: put the files in place**
- File: `.github/skills/smtp-penetration-testing/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/smtp-penetration-testing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/smtp-penetration-testing/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/smtp-penetration-testing

## When to use it
- grab the SMTP banner and identify the mail software
- enumerate valid addresses with VRFY, EXPN and RCPT TO
- check whether the server relays mail for outsiders
- brute force weak SMTP authentication credentials
- inspect STARTTLS support and the cipher list

## Example prompts
- Run an SMTP audit against `mail.example.com`: grab the banner and list the supported extensions
- Enumerate users on this SMTP server with `smtp-user-enum` and the `users.txt` wordlist
- Test whether this server is an open relay and show me the result

## Similar
- [penetration-testing](https://affpapa.org/en/nevibecode/skills/penetration-testing.md) — skill · 1100 installs
- [web-app-penetration-testing](https://affpapa.org/en/nevibecode/skills/web-app-penetration-testing.md) — skill · 12700 installs
- [wordpress-penetration-testing](https://affpapa.org/en/nevibecode/skills/wordpress-penetration-testing.md) — skill · 1100 installs
- [email-smtp-send](https://affpapa.org/en/nevibecode/skills/email-smtp-send.md) — skill · 6800 installs
- [penetration-tester](https://affpapa.org/en/nevibecode/agents/penetration-tester.md) — subagent · 2407 installs
- [Email (IMAP/SMTP)](https://affpapa.org/en/nevibecode/mcp/email-imapsmtp.md) — MCP server · ★ 13

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md