> For the complete documentation index, see [llms.txt](https://edu.noirchapeau.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://edu.noirchapeau.com/footprinting-enumeration-and-information-gathering-notes/imap-pop3-pentesting-notes.md). # IMAP/POP3 Pentesting Notes ## Protocol Overview ### Basic Information **IMAP**: * **Port**: TCP 143 (default), TCP 993 (IMAPS) * **Protocol Type**: Application layer, client-server * **Purpose**: Email access and management on server * **Security**: Plain text by default, supports SSL/TLS **POP3**: * **Port**: TCP 110 (default), TCP 995 (POP3S) * **Protocol Type**: Application layer, client-server * **Purpose**: Email retrieval and deletion * **Security**: Plain text by default, supports SSL/TLS ### Protocol Differences | Feature | IMAP | POP3 | | ---------- | ---------------------------- | ----------------------------- | | Storage | Server-side | Client-side | | Sync | Multi-device sync | Single device | | Management | Full email/folder management | Basic retrieval/deletion | | Connection | Persistent connection | Connect, download, disconnect | ## Initial Enumeration ### Port Scanning ```bash # Basic scan nmap -p110,143,993,995 -sV # Aggressive scan nmap -p110,143,993,995 -sV -sC -A # All related scripts nmap -p110,143,993,995 --script imap* pop3* ``` ### Banner Grabbing ```bash # IMAP nc -nv 143 # POP3 nc -nv 110 # IMAPS openssl s_client -connect :993 # POP3S openssl s_client -connect :995 ``` ## Authentication Testing ### IMAP Authentication ```bash # Using netcat nc -nv 143 a001 LOGIN username password # Using openssl for IMAPS openssl s_client -connect :993 a001 LOGIN username password # Using curl curl -k 'imaps://' --user username:password ``` ### POP3 Authentication ```bash # Using netcat nc -nv 110 USER username PASS password # Using openssl for POP3S openssl s_client -connect :995 USER username PASS password ``` ## Brute Force Attacks ### Using Hydra ```bash # IMAP hydra -l user -P passwords.txt imap hydra -L users.txt -P passwords.txt imap # POP3 hydra -l user -P passwords.txt pop3 hydra -L users.txt -P passwords.txt pop3 ``` ### Using Metasploit ```bash # IMAP use auxiliary/scanner/imap/imap_version use auxiliary/scanner/imap/imap_login # POP3 use auxiliary/scanner/pop3/pop3_version use auxiliary/scanner/pop3/pop3_login ``` ## Command Reference ### IMAP Commands | Command | Description | Example | | ------- | ---------------------- | -------------------------------- | | LOGIN | Authenticate | `a001 LOGIN user pass` | | LIST | List mailboxes | `a002 LIST "" "*"` | | SELECT | Select mailbox | `a003 SELECT INBOX` | | FETCH | Retrieve message | `a004 FETCH 1 BODY[]` | | STORE | Modify flags | `a005 STORE 1 +FLAGS (\Deleted)` | | EXPUNGE | Delete marked messages | `a006 EXPUNGE` | | LOGOUT | End session | `a007 LOGOUT` | ### POP3 Commands | Command | Description | Example | | ------- | ----------------- | --------------- | | USER | Set username | `USER username` | | PASS | Set password | `PASS password` | | STAT | Get mailbox stats | `STAT` | | LIST | List messages | `LIST` | | RETR | Retrieve message | `RETR 1` | | DELE | Delete message | `DELE 1` | | QUIT | End session | `QUIT` | ## Common NSE Scripts ```bash # IMAP Scripts nmap -p143,993 --script imap-capabilities nmap -p143,993 --script imap-ntlm-info nmap -p143,993 --script imap-brute # POP3 Scripts nmap -p110,995 --script pop3-capabilities nmap -p110,995 --script pop3-ntlm-info nmap -p110,995 --script pop3-brute ``` ## SSL/TLS Testing ```bash # Test IMAPS openssl s_client -connect :993 -crlf nmap -p993 --script ssl-enum-ciphers # Test POP3S openssl s_client -connect :995 -crlf nmap -p995 --script ssl-enum-ciphers ``` ## Configuration Files ### Server Configuration * **Dovecot**: `/etc/dovecot/dovecot.conf` * **Courier**: `/etc/courier/imapd`, `/etc/courier/pop3d` * **Cyrus**: `/etc/imapd.conf`, `/etc/cyrus.conf` ### Security Files * **SSL Certificates**: Often in `/etc/ssl/certs/` * **Authentication**: Various PAM or SASL configs ## Common Vulnerabilities 1. **Authentication Issues**: * Clear text transmission * Weak credentials * No rate limiting * Authentication bypass 2. **SSL/TLS Problems**: * Weak ciphers * Outdated protocols * Invalid certificates * Missing encryption 3. **Configuration**: * Debug logging enabled * Anonymous access * Unencrypted ports open * Excessive information disclosure ## Post Exploitation ### Information Gathering * Access email content * Extract attachments * Find sensitive data * Gather internal addresses * Map email relationships ### Privilege Escalation * Check attachment permissions * Search for credentials * Test for command injection * Access configuration files ## Response Codes ### IMAP Response Codes | Code | Meaning | | ------- | ------------------------ | | OK | Command completed | | NO | Command failed | | BAD | Invalid command | | PREAUTH | Authenticated connection | | BYE | Server signing off | ### POP3 Response Codes | Code | Meaning | | ---- | ------------------ | | +OK | Command successful | | -ERR | Command failed | ## Best Practices for Pentesting 1. **Initial Reconnaissance**: * Version identification * SSL/TLS check * Capability enumeration * Authentication methods 2. **Deep Enumeration**: * Vulnerability scanning * User enumeration * SSL/TLS analysis * Configuration review 3. **Documentation**: * Server details * Found vulnerabilities * Access methods * Sensitive data 4. **Risk Assessment**: * Impact analysis * Data sensitivity * Attack vectors * Mitigation recommendations ## Additional Tools 1. **swaks**: ```bash swaks --to user@domain.com --server ``` 2. **evolution**: ```bash evolution --account="imap://" ``` 3. **Custom Python Scripts**: ```python # Basic IMAP connection import imaplib mail = imaplib.IMAP4("") mail.login(user, password) ``` 4. **Misc Tools**: * thunderbird (GUI client) * mutt (terminal client) * alpine (terminal client)