How to find Email addresses?

Hello,
How can I find the email addresses of a domain? For example, I want to know what e-mails are there with domain name “example.com”.
Can I use Telnet tool for this purpose?
I did:

$ nc -v "MyTarget.com" 110
nc: timeout while connecting to X-X-X-X.ptr4.stackcp.net (X.X.X.X) 110 [pop3]
nc: 2a07:7800::152 (2a07:7800::152) 110 [pop3] open

Other ports are open too:

nc: 2a07:7800::152 (2a07:7800::152) 995 [pop3s] open
nc: 2a07:7800::152 (2a07:7800::152) 993 [imaps] open
nc: 2a07:7800::152 (2a07:7800::152) 465 [submissions] open
nc: 2a07:7800::152 (2a07:7800::152) 143 [imap2] open
nc: 2a07:7800::152 (2a07:7800::152) 110 [pop3] open
nc: 2a07:7800::152 (2a07:7800::152) 25 [smtp] open

I don’t like to use some tools like theHarvester.

Thank you.

1 Like

Hey, I noticed your most recent posts. It looks like you’re a beginner, and you have a lot of questions. That’s cool, but I think it would be a good idea for you to learn some fundamentals first, like (network layers, web application/network security, scripting, and basic computer exploitation). Once you understand how things work, you can explore more freely and find the resources you need for hands-on hacking.

3 Likes

There is no easy way to get a list of all email addresses via an email server.
You would have to test every conceivable combination of letters, which becomes difficult before the server blocks you. Also, there are two ways an email server accepts your requests. Either it checks every address you want to send to and rejects false ones (in which case you would get a response) or it takes the email and discards it afterwards.

It also rarely makes sense to want to have all email addresses. It would make more sense to find relevant addresses through social engineering. Job portals like Linkedin are very useful for this.

2 Likes

Hello,
Thank you so much for your link. Is it free?

1 Like

Hello,
Thank you.
I did:

$ proxychains telnet mail.TARGET.com 25
ProxyChains-3.1 (http://proxychains.sf.net)
Connected to mail.TARGET.com.
Escape character is '^]'.
220-mail.TARGET.com ESMTP Postfix
220 mail.TARGET.com ESMTP Postfix
VRFY root
502 5.5.1 VRFY command is disabled
HELO mail.TARGET.com
250 mail.TARGET.com
MAIL FROM:[email protected]
250 2.1.0 Ok
RCPT TO:[email protected]
550 5.7.1 Service unavailable; client [X.X.X.X] blocked using b.barracudacentral.org

As you see, the VRFY command is disabled:

VRFY root
502 5.5.1 VRFY command is disabled

I tried also:

DATA
503 5.5.1 Error: need RCPT command
1 Like

Can someone plz help me with this?

Hello, I have written a Python Script, that is good for that purpose.

You will simply give the link of the website in the prompt, and it will crawl it and find anything with “@“ in it, and eventually will bring out all the emails in every directory and print it in the terminal.