3 ms·
Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?
by jsjohnst 10y ago
Wouldn't a similarly effective method be to script SMTP and see which ones get rejected as envelope to addresses?
- smnscu 10y agoSure, but I imagine there is some form of rate limiting on that, whereas the point of the article is that they found an endpoint without rate limits.
- jsjohnst 10y agoThere might be a rate limit, but it's definitely possible to use this method and get higher than the ~40k a day that the author attained.
- arpa 10y agoNo, google SMTP accepts the RCPT TO with 250 "I'll try my best" regardless of the existence of the email.
- tyingq 10y agoNope, it doesn't do that. >RCPT TO: <someaccountthatdoesnotexist@gmail.com> 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser j63si2824869ybj.160 - gsmtp >RCPT TO: RCPT TO: <john.baker@gmail.com> 250 2.1.5 OK j63si2824869ybj.160 - gsmtp
- arpa 10y agoAh! You're right, my bad, I was thinking about VRFY command!