full-disclosure - TCP port 25 traffic?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <002401c3647e$731a82c0$4802a8c0@Security>
From: joel at helgeson.com (Joel R. Helgeson)
Subject: TCP port 25 traffic?

TCP port 25 traffic?Yeah, I think its called SPAM, not new though....
Try connecting to your server via telnet on port 25 and see if you can get an interactive connection.

type in the following commands:
expn
vrfy

and see if they are accepted.  If so, your server is open to possible attack.

telnet://192.168.0.1:25 will open a telnet session to your server on port 25

Joel R. Helgeson
Director of Networking & Security Services
SymetriQ Corporation

"Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." 
  ----- Original Message ----- 
  From: Josh Karp 
  To: 'full-disclosure@...ts.netsys.com' 
  Sent: Saturday, August 16, 2003 5:45 PM
  Subject: [Full-Disclosure] TCP port 25 traffic?

  I've seen an unusual amount of connection attempts to TCP port 25 on a particular system in my network as of the past 48 hours or so. It's only this one system, and it's multiple source IP's. Is there anything new for SMTP? 

  Thanks for any info... josh 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030817/1cd3f23f/attachment.html