2KKUU7ita

260
Part V: Hacking Applications
Figure 13-8:
Using Goog
Mail Enum
for gleaning
e-mail
addresses
via Google.
Countermeasures against account enumeration
If you’re running Exchange, account enumeration won’t be an issue. If you’re
not running Exchange, the best solution for preventing this type of e-mail
account enumeration depends on whether you need to enable the VRFY and
EXPN commands:
✓ Disable VRFY and EXPN unless you need your remote systems to gather
user and mailing list information from your server.
✓ If you need VRFY and EXPN functionality, check your e-mail server or
e-mail firewall documentation for the ability to limit these commands to
specific hosts on your network or the Internet.