SMTP user enumeration via mail.zendesk.com

Several methods exist that can be used to ██████████ SMTP to enumerate valid usernames and addresses; namely VRFY, EXPN, and RCPT TO. `mail.zendesk.com` does not reply to `EXPN` or `RCPT TO` so we will concentrate on `VRFY` in this report. The VRFY command will request that the receiving SMTP server verify that a given email username is valid. The SMTP server will reply with the login name of the user. This feature can be turned off in sendmail, because allowing it can be a security hole. VRFY commands can be used to probe for login names on a system. An example of this using VRFY is given below, where this list of users ``` admin █████████ ███ support ████ ████████ security test test________________________1 ``` is enumerated: ``` ---------------------------------------------------------- | Scan Information | ---------------------------------------------------------- Mode ..................... VRFY Worker Processes ......... 5 Usernames file ........... names.txt Target count ............. 1 Username count ........... 9 Target TCP port .......... 25 Query timeout ............ 5 secs Target domain ............ ######## Scan started at Thu Dec 22 08:29:37 2016 ######### mail.zendesk.com: ███████ exists mail.zendesk.com: ██████ exists mail.zendesk.com: █████████ exists mail.zendesk.com: ██████ exists mail.zendesk.com: ███ ######## Scan completed at Thu Dec 22 08:29:38 2016 ######### 5 results. 9 queries in 1 seconds (9.0 queries / sec) ``` This can also be manually verified: ``` ███:~$ telnet mail.zendesk.com 25 Trying 192.161.153.1... Connected to mail.zendesk.com. Escape character is '^]'. 220 █████████ ESMTP VRFY █████ 252 2.0.0 ███████ VRFY test___________________1 550 5.1.1 <test___________________1>: Recipient address rejected: User unknown in local recipient table quit 221 2.0.0 Bye Connection closed by foreign host. ``` The `252 2.0.0 █████` message indicates success, while the `550 5.1.1` message indicates failure when the username does not exist on this server. **Mitigation** Disable the `VRFY` command in your SMTP server configuration.