SMTP Cracking 2026: JEX Bot, Hydra & Checkers

[Blackhatpakistan]

SMTP cracking is the quiet middle of the mail-abuse pipeline: someone grabs a list of mail servers, throws credential pairs at ports 465, 587 and 25, and keeps whatever authenticates - then uses the working relay to send mail that arrives in the inbox because it came from a real mail server with a real reputation. No spam panel, no bulletproof hosting invoice, no DKIM saga - just userdata:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7ass pairs meeting an SMTP banner that still trusts passwords. The 2026 tooling scene runs on two rails: the leaked bot family (JEX and its descendants) that automates grab-scan-crack-end-to-end, and the open-source checker class on GitHub that tests, verifies and reports. Below: what the JEX bots actually do, a map of the whole cracking stack with GitHub links, the shell-side rotation trick for anyone holding a cPanel shell, a runnable verifier, and a tool-hygiene ritual because half the leaked bots are password stealers wearing a checker's coat.

TL;DR - SMTP cracking = testing credential combos against mail servers until AUTH succeeds, then using the authenticated session as your sending identity. The JEX bot family (JEx v3/v4/v6, Giga-Bot, NekoBot, Jaguar, Zombie) automates the whole loop - dork grab, CMS scan, FTP/cPanel/SMTP brute, shell upload - and lives on GitHub as leaks: ghostsec420/JexBotv4 (64 stars, BruteForce/Exploits/Tools folders, needs the weblib pip module) and JExCoders/Giga-Bot (the multi-bot collection). The checker class does the surgical work: MailRip V2 (216 stars) verifies login plus inbox access with proxy support, MailRip V3 adds a GUI and IMAP, SMTP-Heist (PyQt6, 2025-active) cracks with Telegram reporting, and Arc4n3 grinds combolists fast. Brute classics still hold the line: hydra, medusa (894 stars), patator (3.9k stars). The pipeline that matters: grab -> normalize combo -> crack -> verify (auth AND deliverability AND inbox) -> test-send -> rotate. Shell holders get a shortcut via smtp-shell-cracker: rotate webmail passwords from an existing cPanel session instead of cracking anything. Rule zero before running anything leaked: treat every "cracked bot" zip as hostile until a VM says otherwise - the 2026 default payload for fake checkers is an infostealer. Six-question self-check below, plus the scoreboard thread where you post your stack - best teardown of a fake checker gets pinned, first fifteen get the proxy/adapter template.

THE JEX BOT FAMILY: WHAT IT ACTUALLY IS

JEX started life as a Python 2 automation bot from the Indonesian scene - a single JEx.py driver with folders bolted on over years of versions. Open ghostsec420/JexBotv4 on GitHub and the anatomy is right there in the file tree: a BruteForce folder, an Exploits folder, a Tools folder, a cms folder for WordPress/Joomla/Drupal targets, and files for grabber output. The README is three lines - leaked by GhostSec, install the weblib pip module, happy hacking - which tells you everything about how these tools travel: no releases, no issues, no docs, just a snapshot somebody dumped after a forum fight.

The feature list across the family reads like a full attack chain because it is one. Auto-grab: dork strings pull potential targets (mail servers, open relays, CMS login pages, exposed FTP) into a working file. Auto-scan: the grab list gets probed for software version, exposed services, default credentials, known CVE. Auto-crack: built-in dictionaries hammer FTP, cPanel, SMTP AUTH and WordPress admin in parallel threads. Auto-exploit: successful CMS access gets a shell dropped, symlink tricks attempt privilege escalation, and the loot (mail creds included) flows back into the grab file for the next loop. Giga-Bot - the JExCoders collection - packages several of these generations together: JEx v3, v4, NekoBot, Jaguar, Zombie v12, Payload v3 and friends, each with its own grabber quirks. By the v6.3 era, the bots were being sold and leaked on spyhackerz-style forums with "last version" stickers, and the GitHub mirrors are where the stickers stopped mattering.

Honest engineering note: this code is ugly. Python 2 print statements, hardcoded Indonesian timezones, credentials logged in plaintext to files, no rate limiting, threads spawned until the box gives up. As reference material it is superb - you can read the exact order a decade of operators learned to work in. As something you run against a box you like, it is a liability. The tool-hygiene section at the end turns that into a checklist.

THE PIPELINE: SIX STAGES FROM GRASS TO INBOX

- Grab - dorks, scanner output or purchased lists produce raw targets: mail.domain.tld with open 465/587, FTP banners, cPanel ports. Quality here decides everything downstream - a clean list of 500 live SMTP hosts beats 50,000 dead ones.
- Normalize combo - pairs get formatted to userdata:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7ass@hostdata:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7ort or split into parallel columns per tool. Dedupe, strip obvious traps (canary addresses, tarpit hosts), tag each line with source so you know what to rotate when a list burns.
- Crack - hydra/medusa/patator for surgical runs, a JEX-family bot or combolist grinder (Arc4n3, Smtp-Cracker-v4) for bulk. Slow threads, randomized user agents on any web-auth path, proxy pools if the tool supports them.
- Verify - authentication is not enough. The verifier connects, logs in, and actually tests mailbox access: IMAP SELECT INBOX, last-message date, and a delivery test to an address you control. MailRip's whole design is this stage - auth plus inbox plus proxy in one pass.
- Test-send - one message, your own seed addresses across Gmail/Outlook/Proton, then seed checks: did it land, did headers survive, did the relay mangle the envelope. Failing this step burns the relay for nothing.
- Rotate - passwords rotate (especially if you used the shell-side trick), IPs rotate, combos get retired from your pool on a schedule. A working SMTP credential is a consumable, not an asset you keep.

THE CHECKER CLASS: GITHUB MAP

The bots grab; the checkers decide what is worth keeping. All links below are live GitHub repositories - star counts are what the page showed this week:

- DrPython3/MailRipV2 - 216 stars. The reference implementation: SMTP/IMAP/POP3 login check with inbox verification and proxy support. Read this one to understand what "verified" should mean.
- DrPython3/MailRipV3 - 107 stars. V3 adds a desktop GUI and tighter IMAP handling for the same verify logic.
- drcrypterdotru/SMTP-Heist - 43 stars, PyQt6, actively updated in 2025 - cracks SMTP with live results pushed to a Telegram channel.
- Aron-Tn/SMTP-CRACKER-V2 and Aron-Tn/SMTP-CRACKER-V3 - the classic dual release, V3 tightening connection handling and threading.
- Arabiabitz/SMTP.Cracker - checks mail access and auto-emails results to you - the loop closes without a results file.
- c0pp3rGuardian/Arc4n3-SMTP-Cracker - combolist-to-SMTP grinder built for speed.
- Free-Spam-Tools/Smtp-Cracker-v4 and 0xSojalSec/-Smtp-cracker-v3 - lighter scripts, useful as readable reference for the verify flow.
- Lesteruwu/smtp-shell-cracker - the shell-side wildcard, covered in its own section below.

BRUTE CLASSICS NEVER RETIRE

Bots come and go; three tools have outlived every scene war. vanhauser-thc/hydra remains the default for single-target surgical runs with its smtp/pop3/imap modules. jmk-foofus/medusa (894 stars) wins on parallel fan-out across many hosts. lanjelot/patator (3.9k stars) wins when you need modular feedback - every protocol is a module, every result is parseable, which matters when a run becomes a pipeline instead of a command.

# surgical: one host, user list, password list, TLS on 465, verbose

hydra -L users.txt -P pass.txt -S -s 465 -V -t 4 -o hydra_smtp.log smtp://mail.example.tld

# fan-out: medusa across many hosts from a target file, module smtp

medusa -H hosts.txt -U users.txt -P pass.txt -M smtp -T 10 -O medusa.log

# patator when you want structured output to feed the verifier

patator smtp_login user=FILE0 pass=FILE1 host=FILE2 -x ignore:code=535

THE VERIFIER: AUTH IS NOT A RESULT

A login that authenticates but cannot receive is worth nothing - catch-all domains and dead relays pollute every pool. The verifier below does what MailRip does internally: authenticate, select the inbox, report the last message date, and optionally ping your seed address. Ten lines of stdlib, no dependencies, runs anywhere.

import smtplib, imaplib, sys

# combo format: user:pass@host:port  (from your normalized list)

def verify(combo, seed=None):

    cred, hostport = combo.rsplit("@", 1)

    user, pw = cred.split(":", 1)

    host, port = (hostport.split(":") + ["587"])[:2]

    try:

        s = smtplib.SMTP(host, int(port), timeout=15)

        s.ehlo(); s.starttls(); s.ehlo()

        s.login(user, pw)

        out = ["AUTH OK"]

        try:

            m = imaplib.IMAP4_SSL(host.split(".")[-2] and host, 993)

            m.login(user, pw); code, data = m.select("INBOX")

            out.append("INBOX OK last=" + str(data[0].decode()))

            m.logout()

        except Exception as e:

            out.append("IMAP FAIL " + str(e)[:40])

        if seed:

            s.sendmail(user, [seed], "Subject: seed\r\n\r\nvia " + host)

            out.append("SEED SENT")

        s.quit()

        print(combo, "|", " | ".join(out))

    except Exception as e:

        print(combo, "| DEAD", str(e)[:60])

for line in open("combos.txt"):

    line = line.strip()

    if line: verify(line, seed="you@seedbox.tld")

SHELL-SIDE: SKIP THE CRACK, ROTATE THE PASSWORD

Here is the shortcut nobody writes guides about. If you already hold a cPanel or webmail shell on a box - a finding from a pentest, a client engagement, a shell your team owns - the SMTP credentials are sitting in the panel: email accounts are listed with their passwords in the cPanel interface, or hashable and resettable in one action. smtp-shell-cracker automates exactly this: from an authenticated cPanel session it pulls the webmail account list, extracts or resets credentials, and outputs them in the same combo format the checkers consume. No brute force, no lockout risk, no noise in auth logs - the access was already legitimate to the session you hold. This is why the technique lives on a node that shares space with cPanel writeups: the fastest SMTP crack is not a crack at all, it is privilege reuse. Legitimate engagements use it to prove mailbox-to-inbox trust boundaries; the mechanics are identical either way, and the detection answer is the same: mail password changes from unfamiliar IPs should page someone.

TOOL HYGIENE: THE LEAKED-BOT PROBLEM

Every "JEX v6 cracked" zip on a forum has, at some point in its life, been repackaged by someone who wanted the runner's browser passwords. The 2026 infostealer economy runs on exactly this temptation: a checker that works perfectly, reports results, and silently lifts Telegram session files, crypto wallets and saved logins while it grinds. The ritual that keeps you upright:

- Clone from GitHub mirrors with history (ghostsec420/JexBotv4, JExCoders/Giga-Bot), not forum Mega links - forum zips are the repackaged layer.
- Run everything first inside an isolated VM with no shared folders and no saved sessions. Real machines get real tools only after the VM run looks clean.
- Strings-and-hash pass: pyinstaller binaries with no source = skip; source that opens unexpected outbound sockets or reads browser profile paths = skip; note the hash of anything you keep so future-you recognizes tampering.
- Read the grabber output paths before running - many bots log creds in plaintext next to the script. That file is also what steals you if the box is shared.
- Prefer the boring checkers. MailRip, patator and a ten-line verifier have no room to hide a payload. The fancy GUI crackers are where the extra code hides.

TEST YOURSELF: SIX QUESTIONS

Score honestly: (1) can you state the difference between "AUTH OK" and a verified, deliverable relay in one sentence? (2) does your pipeline verify inbox access, not just login? (3) do your threads stay low enough that a target's fail2ban never notices? (4) when did you last run a leaked tool in a VM first? (5) is every working credential tagged with source and date so rotation knows what to kill? (6) do you test-send to seed addresses before any real run? Zero to one: your stack is theater. Two to three: functional but brittle - fix verify and hygiene. Four plus: you are running a relay operation, not a script kiddie grind - post the stack below.

POST YOUR STACK

Report in scoreboard format: which checker sits in the verify stage, which brute tool sits in the crack stage, how many proxies your adapter pool holds, and your worst fake-tool story - the zip that turned out to be a stealer, what it went for, how you caught it. No live credentials, describe formats only. Best teardown of a leaked "cracked checker" gets pinned to the top of the node, and the first fifteen posters get the proxy/adapter template (checker-to-pool wiring, retry policy, result schema) via PM.

OPERATOR CHECKLIST

- Combo hygiene - dedupe, source-tag, retire on schedule. Pools rot; running stale lists burns working relays on dead pairs.
- Low and slow - 2 to 4 threads per target, jittered delays, rotate exit IPs if the tool supports proxies. Speed is what turns a crack into an incident.
- Verify means three checks - auth, inbox read, seed delivery. Any one failing demotes the credential to "candidate."
- Warm relays before volume - SPF, DKIM and DMARC alignment plus a few days of gentle traffic, or the first thousand messages route to the spam folder and the relay dies with them.
- Watch the bounce feedback - seed accounts plus postmaster/bounce analysis tell you when a relay's reputation is sliding before the deliverability charts do.
- Log everything with timestamps - which combo, which proxy, which result. When a provider locks the account, the log is what tells you whether you were caught or the target just rotated.
- Treat credentials as consumables - assume every working pair has a lifespan measured in days, build the pipeline so rotation is routine rather than emergency.

FAQ

- Q: Does JEX Bot still work in 2026?

A: The leaks run, but the ecosystem around them rotted - hardcoded dorks target dead CMS versions, Python 2 dependencies fight modern systems, and the repackaged zips are hostile. Read them as documentation of the pipeline; build the pipeline from the boring tools.
- Q: SMTP cracking vs email bombing - what is the difference?

A: Cracking obtains and verifies credentials against a mail server. Bombing is volume abuse of a sending channel. One is an access problem, the other is a throughput problem - the spamming node covers the second half.
- Q: Port 25, 465 or 587 - which one do crackers target?

A: All three, but 465 (SMTPS) and 587 (submission with STARTTLS) authenticate more often on modern servers. Port 25 mostly matters at the relay stage, not the crack stage.
- Q: Why does my verified relay stop delivering after a week?

A: Reputation decay - volume without warm-up, missing alignment, or a spam-folder feedback loop the provider quietly acted on. Verify plus warm-up plus seed monitoring is the counter.
- Q: Is MailRip better than a custom script?

A: For starting out, yes - it encodes the three-stage verify correctly with proxy support. Outgrow it when you need result schemas your pipeline can consume, then the ten-line verifier above becomes the core of your own.
- Q: What is the safest way to study these tools?

A: Source-first from the GitHub mirrors, VM-first for anything executable, and a habit of reading before running. The tool-hygiene section is the whole answer compressed.

RELATED

SMTP Mailers 2026 - The Complete Spamming Guide: Tools, Servers, Distribution, Deliverability

Spamming Methods 2026 - Complete Underground Guide

How Spammers Use AI to Write Undetectable Emails

Credential Stuffing 2026: How Breach Lists Kill Accounts - Check Your Exposure