CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  To enumerate valid email addresses and distribution lists

  Why this is correct

  The SMTP commands VRFY (Verify) and EXPN (Expand) are powerful reconnaissance tools for penetration testers. VRFY is used to confirm the existence of a specific user or mailbox on the target mail server, returning either a valid user name or an error. EXPN, conversely, is designed to reveal the full membership of a mailing list or alias, providing a list of all individual recipients. Both commands, if not properly restricted, allow an attacker to enumerate valid email addresses and distribution lists, which is invaluable for targeted phishing, spam campaigns, or further social engineering efforts.

• ✗

  To extract email content from the server

  Why it's wrong here

  The SMTP commands VRFY and EXPN operate at the protocol level to query recipient information, not message content. Their function is strictly limited to verifying user existence or expanding mailing lists, providing metadata about potential recipients. These commands do not possess any functionality to access, retrieve, or display the actual subject lines, body text, attachments, or any other part of an email message stored on the server. Extracting email content requires different protocols like POP3 or IMAP, typically with authentication.

• ✗

  To perform a mail relay attack

  Why it's wrong here

  Performing a mail relay attack involves an unauthorized third party leveraging an SMTP server to send emails to external domains, effectively using the server as an intermediary for malicious purposes like spam or phishing. While knowing valid email addresses (potentially gained via VRFY/EXPN) might inform a relay attempt, the actual mechanism for initiating a relay involves the `RCPT TO` command. An attacker would specify an external recipient in `RCPT TO`, attempting to bypass the server's authorization checks to send mail outside its local domain. VRFY and EXPN do not directly execute or facilitate the relaying process itself.

• ✗

  To test for open relay

  Why it's wrong here

  Testing for an open relay specifically determines if an SMTP server will accept and forward email from an unauthorized sender to an external, non-local recipient without requiring authentication. This test primarily involves sending a series of SMTP commands, notably `MAIL FROM` and `RCPT TO`, where the `RCPT TO` address is an external domain. The server's response to this sequence indicates whether it functions as an open relay. VRFY and EXPN, however, are used for user enumeration and do not directly probe the server's relaying policy or its willingness to forward mail to external destinations.

Go deeper

Related to this question