CEH Enumeration and System Hacking Practice Question

A penetration tester wants to enumerate user accounts on a Linux system running SMTP service. Which commands are commonly used for this purpose?

⚠ Common exam trap

Candidates often confuse SMTP enumeration commands (VRFY, EXPN, RCPT TO) with SMTP session commands (HELO, MAIL FROM, DATA) or with authentication commands (AUTH LOGIN, STARTTLS), leading them to select options that are valid SMTP commands but not designed for user enumeration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

VRFY, EXPN, RCPT TO

The VRFY command verifies whether a user mailbox exists on the SMTP server, EXPN expands a mailing list or alias to reveal individual member addresses, and RCPT TO specifies the recipient for a mail message and can be used to validate addresses during the SMTP conversation. These three commands are the standard SMTP enumeration techniques for discovering valid user accounts on a Linux system running an SMTP service.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
USER, PASS, QUIT
Why it's wrong here
The commands USER, PASS, and QUIT are fundamental to protocols like FTP (File Transfer Protocol) and POP3/IMAP (Post Office Protocol 3 / Internet Message Access Protocol) for user authentication and session termination. While they involve user credentials, they are not standard SMTP (Simple Mail Transfer Protocol) commands and therefore cannot be used to enumerate user accounts on an SMTP server. Attempting to use these commands against an SMTP service would result in unrecognized command errors, as SMTP operates with a distinct set of instructions for mail transfer.
✓
VRFY, EXPN, RCPT TO
Why this is correct
The VRFY (Verify) and EXPN (Expand) commands are specifically designed to query an SMTP server about the existence of a user or the members of a mailing list, respectively, often revealing valid account names. Additionally, the RCPT TO (Recipient To) command, while primarily for specifying a mail recipient, can be leveraged for enumeration by observing the server's response: a '250 OK' or similar success code indicates a valid user, whereas a '550 No such user' or '551 User not local' signifies an invalid one. These three commands collectively provide robust methods for identifying valid user accounts on an SMTP server.
✗
AUTH LOGIN, STARTTLS, EHLO
Why it's wrong here
AUTH LOGIN, STARTTLS, and EHLO are all valid SMTP or ESMTP (Extended SMTP) commands, but they serve different purposes than user enumeration. AUTH LOGIN is an authentication mechanism, initiating a challenge-response sequence for client login rather than revealing existing accounts. STARTTLS is used to upgrade an existing insecure connection to a secure TLS/SSL encrypted one, enhancing communication privacy. EHLO (Extended Hello) is the initial command to start an ESMTP session and declare client capabilities, not to query for user existence.
✗
HELO, MAIL FROM, DATA
Why it's wrong here
HELO, MAIL FROM, and DATA are core commands in the standard SMTP mail transfer process, not for user enumeration. HELO initiates the SMTP session, identifying the client to the server. MAIL FROM specifies the sender's email address, a necessary step for message origin. DATA signals the server that the actual email content (headers and body) will follow, leading to message delivery. None of these commands are designed to query the server for the existence of recipient accounts; they are focused on the mechanics of sending an email.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question