POP3 (Port 110, 995)

Enumerate and interact with POP3 (Post Office Protocol) mail servers to retrieve emails and discover credentials.
POP3 is commonly used for downloading emails from a mail server, with port 110 for unencrypted and 995 for SSL/TLS connections.

Netcat

nc -nv 10.10.10.10 110

Telnet

telnet 10.10.10.10 110

OpenSSL (POP3S - Port 995)

openssl s_client -connect 10.10.10.10:995

POP3 Commands

Authentication

# Connect and authenticate
USER username
PASS password

Mailbox Operations

# Check mailbox status
STAT

# List all emails
LIST

# List specific email
LIST 1

# Retrieve email by ID
RETR 1

# Delete email by ID
DELE 1

# Show server capabilities
CAPA

# Reset session (undelete marked emails)
RSET

# Close connection
QUIT

Enumeration

Nmap Scripts

# POP3 enumeration
nmap -p110,995 --script pop3-capabilities,pop3-ntlm-info 10.10.10.10

# Check for vulnerabilities
nmap -p110,995 --script pop3-brute 10.10.10.10

Manual Enumeration

# Connect and check capabilities
nc -nv 10.10.10.10 110
CAPA
USER test
PASS test
STAT
LIST
RETR 1
QUIT

Brute Force

Hydra

# POP3 brute force
hydra -l user -P /usr/share/wordlists/rockyou.txt pop3://10.10.10.10

# POP3S brute force
hydra -l user -P /usr/share/wordlists/rockyou.txt pop3s://10.10.10.10

Nmap

nmap -p110 --script pop3-brute --script-args userdb=users.txt,passdb=passwords.txt 10.10.10.10

cURL Access

Download Emails

# List emails
curl -k 'pop3://10.10.10.10' --user user:password

# Retrieve specific email
curl -k 'pop3://10.10.10.10/1' --user user:password

# POP3S
curl -k 'pop3s://10.10.10.10' --user user:password

Notes

Dangerous Settings:

  • auth_debug - Enables all authentication debug logging
  • auth_debug_passwords - Logs submitted passwords and authentication schemes
  • auth_verbose - Logs unsuccessful authentication attempts with reasons
  • auth_verbose_passwords - Passwords used for authentication are logged
  • auth_anonymous_username - Username for ANONYMOUS SASL mechanism

Security Considerations:

  • POP3 transmits credentials in cleartext on port 110
  • Always use POP3S (port 995) when possible for encrypted communication
  • Check for default credentials and weak passwords
  • POP3 typically downloads and deletes emails from server (unlike IMAP)

Common Misconfigurations:

  • Anonymous access enabled
  • Weak or default credentials
  • Verbose logging exposing credentials
  • Unencrypted connections allowed

Email Retrieval:

  • POP3 downloads emails to local client and typically deletes from server
  • IMAP keeps emails on server and syncs across devices
  • POP3 is simpler but less flexible than IMAP
⬆︎TOP