CEH Enumeration and System Hacking Practice Question
An attacker uses a tool that sends crafted RCPT TO commands to an SMTP server to verify email addresses. Which SMTP enumeration technique is being used?
⚠ Common exam trap
Watch out — candidates often confuse RCPT TO with VRFY, assuming VRFY is the primary enumeration command, but in practice, VRFY is frequently disabled, making RCPT TO the more reliable and commonly tested technique in CEH scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RCPT TO
The RCPT TO command is used in SMTP to specify the recipient of an email. By sending crafted RCPT TO commands to an SMTP server, an attacker can observe the server's response (e.g., '250 OK' for valid addresses vs. '550 No such user' for invalid ones) to enumerate valid email addresses. This technique directly exploits the SMTP protocol's recipient verification behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AUTH
Why it's wrong here
The AUTH command initiates an authentication dialogue between the SMTP client and server, typically using mechanisms like PLAIN or LOGIN to verify the sender's credentials. Its sole purpose is to establish a trusted session for mail relay, not to query the existence of recipient addresses. Therefore, an attacker sending crafted RCPT TO commands would not be leveraging the AUTH command for enumeration, as it serves a fundamentally different security function.
- ✓
RCPT TO
Why this is correct
The RCPT TO:<address@domain.com> command is a fundamental SMTP instruction used to specify an intended recipient for an email. Attackers exploit this by sending numerous RCPT TO commands with guessed email addresses to a target mail server. The server's response, such as a 250 OK for a valid address or a 550 No such user here for an invalid one, allows for systematic enumeration of active email accounts. This method is highly effective for building target lists for further attacks.
- ✗
EXPN
Why it's wrong here
The EXPN (Expand) command is an SMTP feature designed to request the server to reveal the members of a mailing list or alias. While it can disclose valid email addresses by expanding group definitions, it operates on aliases rather than individual recipient attempts for mail delivery. The question specifically refers to an attacker using 'crafted RCPT TO commands,' making EXPN, despite its enumeration potential, an incorrect answer for the described method.
- ✗
VRFY
Why it's wrong here
The VRFY (Verify) command is an SMTP command explicitly designed to verify the existence of a user on the local mail system without attempting to send mail. It directly queries the server for user validity and returns a success or failure code. Although VRFY is a direct method for email address enumeration, the question explicitly states the attacker is using 'crafted RCPT TO commands,' which is a distinct and often more widely available enumeration technique.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.