Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

You can choose which methods to try (RCPT, VRFY, and EXPN), and the order in which to try them, with the script argument smtp-enum-users.methods:

$ nmap -p25 --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY,EXPN,RCPT} <target>$ nmap -p25 --script smtp-enum-users --script-args smtp-enum-users.methods={RCPT, VRFY} <target>  

To set a different domain in the SMTP commands, use the script argument smtp-enum-users.domain:

$ nmap -p25 --script smtp-enum-users --script-args smtp-enum-users.domain=<domain> <target>  

The NSE script smtp-enum-users depends on the unpwdb library, which is highly configurable. Read Appendix B, Brute Force Password Auditing Options, to learn more about the advanced options available. ...