Hacktricks-skills pop3-pentesting

How to enumerate, test, and exploit POP3 mail servers during security assessments. Use this skill whenever the user mentions POP3, port 110, port 995, email server testing, mail server enumeration, or any task related to testing Post Office Protocol services. This includes banner grabbing, capability enumeration, brute force attacks, and identifying misconfigurations that expose credentials.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest: skills/network-services-pentesting/pentesting-pop/SKILL.MD

source content

POP3 Pentesting Skill

A comprehensive guide for testing Post Office Protocol (POP3) mail servers during security assessments.

Quick Reference

Port	Service	Protocol
110	POP3	Unencrypted
995	POP3S	SSL/TLS Encrypted

Enumeration

Banner Grabbing

Start by connecting to the POP3 service to identify the server software and version:

Unencrypted (port 110):

nc -nv <target-ip> 110

Encrypted (port 995):

openssl s_client -connect <target-ip>:995 -crlf -quiet

Using the bundled script:

./scripts/banner_grab.sh <target-ip> [port]

Nmap Scanning

Run Nmap with POP3-specific scripts to enumerate capabilities and detect NTLM authentication:

nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p 110,995 <target-ip>

Using the bundled script:

./scripts/nmap_pop3_scan.sh <target-ip>

The

pop3-ntlm-info

script can reveal sensitive Windows version information.

Metasploit Enumeration

Quick version enumeration without launching the full console:

msfconsole -q -x 'use auxiliary/scanner/pop3/pop3_version; set RHOSTS <target-ip>; set RPORT 110; run; exit'

Manual POP3 Commands

Connect via telnet or netcat and use these commands:

Command	Description
`USER <username>`	Log in as specified user
`PASS <password>`	Provide password
`STAT`	List message count and mailbox size
`LIST`	List all messages with sizes
`RETR <n>`	Retrieve message number n
`DELE <n>`	Mark message n for deletion
`RSET`	Reset/undo changes
`QUIT`	Logout (deletes marked messages)
`TOP <msg> <n>`	Show first n lines of message
`CAPA`	Get server capabilities

Example Session

telnet <target-ip> 110
+OK beta POP3 server (JAMES POP3 Server 2.3.2) ready

USER billydean
+OK

PASS password
+OK Welcome billydean

LIST
+OK 2 1807
1 786
2 1021

RETR 1
+OK Message follows
From: jamesbrown@motown.com
Dear Billy Dean,

Here is your login for remote desktop ... try not to forget it this time!
username: billydean
password: PA$$W0RD!

Brute Force Attacks

Using Hydra

When you have a username and password list:

hydra -l <username> -P <password-list> -f <target-ip> pop3 -V

Parameters:

```
-l
```
: Single username
```
-P
```
: Password list file
```
-f
```
: Stop on first success
```
-V
```
: Verbose output

Using Metasploit

msfconsole
use auxiliary/scanner/pop3/pop3_login
set RHOSTS <target-ip>
set RPORT 110
set USER_FILE /path/to/users.txt
set PASS_FILE /path/to/passwords.txt
run

Common Vulnerabilities

Password Logging Misconfigurations

Some POP3 servers log passwords in cleartext when debug settings are enabled:

```
auth_debug
```
- Increases log verbosity
```
auth_debug_passwords
```
- Logs passwords in cleartext
```
auth_verbose_passwords
```
- Verbose password logging

Check server logs if you gain access to the mail server filesystem:

grep -i "password" /var/log/mail.log
grep -i "auth" /var/log/mail.log

Weak Credentials

POP3 servers often have:

Default credentials
Weak passwords
Reused credentials from other services

Information Disclosure

Email messages may contain:

Credentials for other systems
Sensitive business information
Internal network details

Workflow

Reconnaissance: Identify POP3 services on target
Banner Grabbing: Determine server software and version
Capability Enumeration: Use CAPA command and Nmap scripts
Credential Testing: Attempt known credentials or brute force
Message Analysis: Review retrieved emails for sensitive data
Log Analysis: Check for password logging misconfigurations

Safety Notes

Always obtain proper authorization before testing
POP3 credentials may grant access to sensitive email data
Some brute force attempts may trigger account lockouts
Document all findings for the security assessment report

Bundled Scripts

See the

scripts/

directory for:

```
banner_grab.sh
```
- Automated banner grabbing
```
nmap_pop3_scan.sh
```
- Nmap scanning wrapper
```
pop3_enum.sh
```
- Comprehensive enumeration helper