# IMAP

> Email access protocol syncing messages with server.

- **URL:** https://hackindex.io/services/imap
- **Type:** Service
- **Default ports:** 143, 993
- **Tags:** imap, email, network, protocol, authentication, linux
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

IMAP (Internet Message Access Protocol) manages email on a mail server, running on **TCP port 143** (plaintext) and **TCP port 993** (IMAPS with TLS). Nmap identifies them as `imap` and `imaps`. Common IMAP servers include Dovecot, Courier, Cyrus, and Microsoft Exchange.

IMAP on port 143 transmits credentials in cleartext unless STARTTLS is enforced. Successful authentication grants full access to a user's mailbox, including all folders. Emails frequently contain credentials, internal documents, VPN configs, password reset links, and other sensitive data that advances an engagement.

Banner grab to identify the server and version. Test with known or guessed credentials, then enumerate folders and download messages. Nmap's `imap-capabilities` and `imap-ntlm-info` scripts reveal supported features and, on Exchange, domain and server names.

## Phases

- [Enumeration](https://hackindex.io/services/imap/enumeration.md): Enumerate IMAP capabilities, auth methods, and NTLM info (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/imap/vulnerability-discovery.md): Guides for testing weak IMAP auth and cleartext credential risks (1 guides)
- [Exploitation](https://hackindex.io/services/imap/exploitation.md): Brute force IMAP logins and harvest mailbox data after access (2 guides)