id: expn-mail-detect
info:
name: EXPN Mail Server Detect
author: r3dg33k
severity: info
description: |
The "EXPN" can be used by attackers to learn about valid usernames on the target system. On some SMTP servers, EXPN can be used to show the subscribers of a mailing list subscription lists are generally considered to be sensitive information.
metadata:
max-request: 1
tags: mail,expn,network,detect
tcp:
- inputs:
- data: "65686c6f20636865636b746c730a"
type: hex
read-size: 2048
host:
- "{{Hostname}}"
port: 25
matchers:
- type: word
words:
- "250-EXPN"
