From 75531cf5f74afde1ff7f69ce970d2dbcfcdc8cbf Mon Sep 17 00:00:00 2001
From: Mohammad D <mohammadamindehghani@pm.me>
Date: Sun, 26 May 2024 23:42:47 +0330
Subject: [PATCH] Update missing smtp ports

---
 network/detection/expn-mail-detect.yaml          | 6 +++---
 network/detection/starttls-mail-detect.yaml      | 6 +++---
 network/enumeration/smtp/smtp-commands-enum.yaml | 6 +++---
 network/enumeration/smtp/smtp-user-enum.yaml     | 6 +++---
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/network/detection/expn-mail-detect.yaml b/network/detection/expn-mail-detect.yaml
index 730b5ac4d3..6c43bc92d8 100644
--- a/network/detection/expn-mail-detect.yaml
+++ b/network/detection/expn-mail-detect.yaml
@@ -2,12 +2,12 @@ id: expn-mail-detect
 
 info:
   name: EXPN Mail Server Detect
-  author: r3dg33k
+  author: r3dg33k,userdehghani
   severity: info
   description: |
     The "EXPN" can be used by attackers to learn about valid usernames on the target system. On some SMTP servers, EXPN can be used to show the subscribers of a mailing list subscription lists are generally considered to be sensitive information.
   metadata:
-    max-request: 1
+    max-request: 4
   tags: mail,expn,network,detect,smtp
 
 tcp:
@@ -18,7 +18,7 @@ tcp:
 
     host:
       - "{{Hostname}}"
-    port: 25
+    port: 25,2525,465,587
 
     matchers:
       - type: word
diff --git a/network/detection/starttls-mail-detect.yaml b/network/detection/starttls-mail-detect.yaml
index d14256180b..45e0be3e07 100644
--- a/network/detection/starttls-mail-detect.yaml
+++ b/network/detection/starttls-mail-detect.yaml
@@ -2,12 +2,12 @@ id: starttls-mail-detect
 
 info:
   name: STARTTLS Mail Server Detection
-  author: r3dg33k
+  author: r3dg33k,userdehghani
   severity: info
   description: |
     STARTTLS is an email protocol command that tells an email server that an email client, including an email client running in a web browser, wants to turn an existing insecure connection into a secure one.
   metadata:
-    max-request: 1
+    max-request: 4
   tags: mail,starttls,network,detect,smtp
 
 tcp:
@@ -18,7 +18,7 @@ tcp:
 
     host:
       - "{{Hostname}}"
-    port: 25
+    port: 25,2525,465,587
 
     matchers:
       - type: word
diff --git a/network/enumeration/smtp/smtp-commands-enum.yaml b/network/enumeration/smtp/smtp-commands-enum.yaml
index bf7c6371df..95ad692f83 100644
--- a/network/enumeration/smtp/smtp-commands-enum.yaml
+++ b/network/enumeration/smtp/smtp-commands-enum.yaml
@@ -2,14 +2,14 @@ id: smtp-commands-enum
 
 info:
   name: SMTP Commands Enumeration
-  author: pussycat0x
+  author: pussycat0x,userdehghani
   severity: info
   description: |
     Attempts to use EHLO and HELP to gather the Extended commands supported by an SMTP server.
   reference:
     - https://nmap.org/nsedoc/scripts/smtp-commands.html
   metadata:
-    max-request: 1
+    max-request: 4
     shodan-query: smtp
     verified: true
   tags: network,enum,smtp,mail
@@ -23,7 +23,7 @@ tcp:
 
     host:
       - "{{Hostname}}"
-    port: 25
+    port: 25,2525,465,587
 
     matchers:
       - type: word
diff --git a/network/enumeration/smtp/smtp-user-enum.yaml b/network/enumeration/smtp/smtp-user-enum.yaml
index 6413362b1b..b8bfad3a4f 100644
--- a/network/enumeration/smtp/smtp-user-enum.yaml
+++ b/network/enumeration/smtp/smtp-user-enum.yaml
@@ -2,14 +2,14 @@ id: smtp-user-enum
 
 info:
   name: SMTP User Enumeration
-  author: pussycat0x
+  author: pussycat0x,userdehghani
   severity: medium
   description: |
     enumerate the users on a SMTP server by issuing the VRFY/EXPN commands
   reference:
     - https://nmap.org/nsedoc/scripts/smtp-enum-users.html
   metadata:
-    max-request: 1
+    max-request: 4
     shodan-query: smtp
     verified: true
   tags: network,enum,smtp,mail
@@ -23,7 +23,7 @@ tcp:
 
     host:
       - "{{Hostname}}"
-    port: 25
+    port: 25,2525,465,587
 
     attack: batteringram
     payloads: