A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
The client had 2,000 employees. They had spent six figures on email security gateways, DMARC policies, and user awareness training. And their internal SMTP server was configured as an open relay. No authentication required. I sent a phishing email from ceo@theircompany.com to all-staff@theircompany.com. The email landed in inboxes. No spam filter triggered. No authentication challenge. Four minutes from nmap scan to delivered phishing email.
14 out of 16 relay tests passed. The server will relay mail from any source to any destination without authentication. This means you can spoof any sender address. The CEO. The IT department. The password reset system. Whatever you want. The receiving mail server sees the email coming from the organization's own infrastructure. It trusts it.
252 means the user exists. 550 means they do not. Three telnet commands and you have confirmed valid accounts. Automate this with smtp-user-enum against a wordlist of common usernames. Feed the valid ones into a password spray. The SMTP server just handed you your target list.
Email attacks are the highest-impact finding on most engagements. Not because of the technical complexity. Because of the human element. A phishing email from the CEO's address, delivered through the company's own mail server, bypasses every technical control. The user sees a familiar sender. They click. Game over. Check SMTP configuration on every internal mail server you find. The open relay is rarer than it used to be, but it is not extinct.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.