CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  EHLO, AUTH, STARTTLS

  Why it's wrong here

  EHLO, AUTH, and STARTTLS are commands designed for establishing and securing an SMTP session, not for user enumeration. EHLO initiates an extended SMTP session, allowing the client to advertise its capabilities and the server to respond with supported extensions. AUTH is used for client authentication to the SMTP server, typically requiring credentials, while STARTTLS upgrades an existing insecure connection to an encrypted one using Transport Layer Security, ensuring privacy and integrity for subsequent communication.

• ✗

  HELO, MAIL FROM, RCPT TO, DATA

  Why it's wrong here

  The sequence HELO, MAIL FROM, RCPT TO, and DATA represents the standard protocol flow for sending an email message through an SMTP server. HELO identifies the sending client, MAIL FROM specifies the sender's email address, RCPT TO designates the recipient, and DATA initiates the transmission of the email's content. While RCPT TO individually can be used for verification, its inclusion in this full sequence indicates an intent to deliver mail, not solely to enumerate users without sending a message.

• ✗

  NOOP, QUIT, RSET

  Why it's wrong here

  NOOP, QUIT, and RSET are SMTP commands primarily used for session management and control, not for discovering valid user accounts. NOOP (No Operation) is a simple command used to keep the connection alive or test server responsiveness without performing any action. QUIT gracefully terminates the SMTP session, and RSET aborts the current mail transaction and resets the session state, clearing any pending sender or recipient information, none of which reveal valid user accounts.

• ✓

  VRFY, EXPN, RCPT TO

  Why this is correct

  VRFY, EXPN, and RCPT TO are effective SMTP commands for enumerating valid user accounts and aliases on a mail server. VRFY (Verify) explicitly requests the server to confirm if a specified user or mailbox exists, often returning a 250 OK response for valid users or a 550 error for non-existent ones. EXPN (Expand) requests the server to expand a mailing list or alias, revealing the individual members or addresses it contains. RCPT TO, even without a subsequent DATA command, can be used to test for recipient validity by observing the server's response code (e.g., 250 OK vs. 550 User unknown).

Go deeper

Related to this question