Footprinting Module - SMTP user enum

I try to further enumerate the SMTP server in order to find user that exist on the system. I am using smtp-user-enum with the wordlist provided in the resource.
I set the timeout to 10seconds and got 11 users firstname@inlanefreight.htb but none of them (with and without @inlanefreight.htb) is accepted as the solution to the question.

I think I am missing something here, but what?

Ok - obviously right after posting this question - I found the solution. I had to use a different tool than smtp-user-enum but I am still puzzled why I get different results from different tools.

  • smtp-user-enum: 11 users
  • other tool (not posting yet which one) only returns one (which is the correct one)

Could someone explain to me why there are so different results from different tools?

I had exactly the same problem

1 Like

What services running on the server did you discover in your enumeration? I think you are overlooking some service that you need to solve this lab.
Just for confirm, you are on the hard lab?

It’s an intermediate module called Footprinting at the HTB Academy. SMTP section

Oh I’m sorry, for some reason I think you are on the hard lab. LOL

Ok, do you tried enuramerate manully the users? I mean, put one by one the users in service over telnet or netcat connection?

NP. I said I had the same issue which means I don’t have it anymore :slight_smile:

If someone has the problem I could help.


Set the timeout to 15 seconds!

How do you set the time out ti 15 seconds? I might have missed something but I honestly don’t know how or where to set the time out?

smtp-user-enum -h
options are:
-m n Maximum number of processes (default: 5)
-M mode Method to use for username guessing EXPN, VRFY or RCPT (default: VRFY)
-u user Check if user exists on remote system
-f addr MAIL FROM email address. Used only in “RCPT TO” mode (default: user[@]example[.]com)
-D dom Domain to append to supplied user list to make email addresses (Default: none)
-U file File of usernames to check via smtp service
-t host Server host running smtp service
-T file File of hostnames running the smtp service
-p port TCP port on which smtp service runs (default: 25)
-d Debugging output
-w n Wait a maximum of n seconds for reply (default: 5)
-v Verbose
-h This help message

Provider SMTP 100% Inbox - SMTP for Spamming - Send unlimited emails per day - Spam Tools - SMTP settings for Inbox Office 365 - Sms Spamming - Bulletproof cPanels & Shells for scampage Craxs RAT - Fud Crypter - XWorm RAT

Contact :
Website :
Telegram Channel : @zexoclub
Telegram : @zex0club