2KKUU7ita

258
Part V: Hacking Applications
Figure 13-5:
Using VRFY
to verify that
an e-mail
address
exists.
Figure 13-6:
Using EXPN
to verify that
a mailing list
exists.
Account enumeration
A clever way that attackers can verify whether e-mail accounts exist on a
server is simply to telnet to the server on port 25 and run the VRFY command.
The VRFY — short for verify — command makes a server check
whether a specific user ID exists. Spammers often automate this method to
perform a directory harvest attack (DHA), which is a way of gleaning valid
e-mail addresses from a server or domain so hackers know whom to send
spam, phishing, or malware-infected messages to.
Attacks using account enumeration
Figure 13-5 shows how easy it is to verify an e-mail address on a server with
the VRFY command enabled. Scripting this attack can test thousands of
e-mail address combinations.
The SMTP command EXPN — short for expand — might allow attackers to
verify what mailing lists exist on a server. You can simply telnet to your e-mail
server on port 25 and try EXPN on your system if you know of any mailing lists
that might exist. Figure 13-6 shows how the result might look. Scripting this
attack and testing thousands of mailing list combinations is simple.