TABLE OF CONTENTS In addition to FTP and DNS, there are a variety of other popular application layer protocols that contain insecurities. Many of these weaknesses are well-known, and some of them have been addressed by updates or add-ons to the protocol. However, some of the application protocols used every day still contain vulnerabilities that are easily exploited.
The Simple Mail Transfer Protocol (SMTP) is used to deliver e-mail messages over the Internet.This protocol is used by most e-mail clients to deliver messages to the server, and is also used by servers to forward messages to their final destination. SMTP is only used for delivery; it cannot be used to retrieve e-mail messages from servers. SMTP servers, also known as Mail Transfer Agents (MTAs), typically listen on port 25/TCP.They use DNS Message Exchange (MX) records to determine the mail server address for a particular domain name. Like some of the previously discussed application layer protocols, SMTP is very old and was not designed with security in mind.
SMTP uses ASCII text for communication. Similar to FTP, the client sends commands to the server, and the server replies with a numeric response code followed by an optional message.
For the following example, we connect directly to an SMTP server with a Telnet client and feed it commands in order to send an e-mail.The output from this example is shown in Code Listing 8.3.
hackthestack@localhost> <b class="bold">telnet localhost...
