| title | swaks | |||||
|---|---|---|---|---|---|---|
| type | tool | |||||
| tags |
|
|||||
| date_created | 2026-07-03 | |||||
| date_updated | 2026-07-03 | |||||
| sources | ||||||
| phase | recon |
swaks (Swiss Army Knife for SMTP) scripts and inspects SMTP transactions: test open relay, enumerate users (VRFY/EXPN/RCPT), check AUTH and STARTTLS, and send crafted mail for spoofing/phishing checks.
apt install swaksswaks --to user@target.com --server mail.target.com # basic delivery test
swaks --to a@ext --from b@ext --server mx.target.com # open-relay test (ext -> ext)
swaks --to user@t --server mx --quit-after RCPT # RCPT-based user enum
swaks --to u@t --server mx -tls --auth -au user -ap pass# open relay: external sender AND external recipient accepted = misconfig
for u in $(cat users.txt); do swaks --to $u@t --server mx --quit-after RCPT 2>&1 | grep -E '25[05]|550'; done
swaks --to victim@t --from ceo@t --server mx --header 'Subject: test' # spoof / SPF-DMARC check- Relay and enum behaviour vary by MTA; read the raw SMTP response codes, do not infer.
- VRFY/EXPN are usually disabled; RCPT-response differencing is the reliable enum path.
- Ties into [[smtp-smuggling]] and [[email-address-parsing-attacks]].
- Prefer swaks over a hand-rolled
/dev/tcpSMTP loop: cleaner transcript, TLS/AUTH support.
[[smtp-smuggling]], [[email-address-parsing-attacks]]
Vault-resident; swaks docs.