IMAP

IMAP (Internet Message Access Protocol) manages email on a mail server, running on TCP port 143 (plaintext) and TCP port 993 (IMAPS with TLS). Nmap identifies them as imap and imaps. Common IMAP servers include Dovecot, Courier, Cyrus, and Microsoft Exchange.

IMAP on port 143 transmits credentials in cleartext unless STARTTLS is enforced. Successful authentication grants full access to a user's mailbox, including all folders. Emails frequently contain credentials, internal documents, VPN configs, password reset links, and other sensitive data that advances an engagement.

Banner grab to identify the server and version. Test with known or guessed credentials, then enumerate folders and download messages. Nmap's imap-capabilities and imap-ntlm-info scripts reveal supported features and, on Exchange, domain and server names.