f

Author: carlospolop

src/network-services-pentesting/pentesting-smtp/README.md

@@ -16,6 +16,22 @@ PORT   STATE SERVICE REASON  VERSION
 25/tcp open  smtp    syn-ack Microsoft ESMTP 6.0.3790.3959
 ```
 
+## Email Security Gateways (SEGs)
+
+As mentioned in this [blog post](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/) **Secure Email Gateways (SEGs)** sit **in-line** with inbound mail flow by **changing MX records** to point to the SEG instead of the mail server. The SEG inspects inbound mail (e.g., IP reputation, blocklists, SPF checks, spoofing detection, metadata/content analysis, sandboxing, URL rewriting) and then forwards, drops, or quarantines messages based on policy. The security model assumes **all inbound mail reaches the SEG first**; if the mail server can be reached directly, the SEG can be **avoided** (similar to skipping a WAF by talking to the origin directly).
+
+### Avoiding SEGs via MX mismatch
+
+Organizations using Entra ID / Exchange Online often have **multiple accepted domains**. If **any accepted domain** has an MX record that **points directly to the mail server** (e.g., Exchange Online) instead of the SEG, you can deliver mail to that domain and **avoid the SEG**. This is a **misconfiguration** (not a vulnerability) but still a common gap.
+
+Also note the default `<tenant>.onmicrosoft.com` domain: its MX record always points to Exchange Online. If inbound to `*.onmicrosoft.com` is **not locked down**, sending to `user@<tenant>.onmicrosoft.com` may land directly in the inbox while bypassing the SEG.
+
+**Defensive notes**:
+
+- Lock down inbound to `*.onmicrosoft.com`.
+- Regularly audit accepted domains and their MX routing.
+- Configure mail servers to **only accept** inbound from the SEG.
+
 ### EMAIL Headers
 
 If you have the opportunity to **make the victim send you a email** (via contact form of the web page for example), do it because **you could learn about the internal topology** of the victim seeing the headers of the mail.
@@ -551,6 +567,7 @@ submit.cf
 
 - [https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/](https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/)
 - [https://www.reddit.com/r/HowToHack/comments/101it4u/what_could_hacker_do_with_misconfigured_smtp/](https://www.reddit.com/r/HowToHack/comments/101it4u/what_could_hacker_do_with_misconfigured_smtp/)
+- <https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/>
 
 ## HackTricks Automatic Commands
 
@@ -607,4 +624,3 @@ Entry_8:
 
 {{#include ../../banners/hacktricks-training.md}}
 
-