Skip to content
HackIndex logo

HackIndex

IMAP enumeration

4 min read Mar 29, 2026

IMAP enumeration extracts server capabilities, authentication mechanisms, NTLM metadata, and TLS configuration from ports 143 and 993. Port 143 is plaintext IMAP unless upgraded with STARTTLS. Port 993 uses implicit TLS. The CAPABILITY response on each port often differs — AUTH methods are sometimes only advertised after TLS negotiation, and LOGINDISABLED on port 143 confirms whether the server enforces TLS before login. With valid credentials, IMAP provides richer mailbox access than POP3 through folder enumeration, server-side search, and non-destructive read-only selection via EXAMINE.

Service Discovery

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 143,993 $TARGET_IP 
143/tcp open  imap    Dovecot imapd
993/tcp open  ssl/imap Dovecot imapd

Capability and NTLM Enumeration

┌──(kali㉿kali)-[~]
└─$ nmap -p 143,993 --script imap-capabilities,imap-ntlm-info $TARGET_IP 
| imap-capabilities:
|   IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
|   STARTTLS LOGINDISABLED AUTH=PLAIN AUTH=LOGIN
| imap-ntlm-info:
|   Target_Name: COMPANY
|   NetBIOS_Domain_Name: COMPANY
|   DNS_Domain_Name: company.local
|   DNS_Computer_Name: mail01.company.local
|_  Product_Version: 10.0.17763

LOGINDISABLED on port 143 confirms the server blocks LOGIN before STARTTLS — this is correct behavior. Its absence means plaintext login is accepted. NTLM info reveals domain, hostname, and Windows version without credentials — immediately useful for AD targeting.

Manual CAPABILITY — Port 143

┌──(kali㉿kali)-[~]
└─$ printf 'a0 CAPABILITY\r\na1 LOGOUT\r\n' | nc -nv $TARGET_IP 143 
* OK Dovecot ready.
* CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS STARTTLS LOGINDISABLED AUTH=PLAIN
a0 OK Pre-login capabilities listed.
* BYE Logging out
a1 OK Logout completed.

CAPABILITY After STARTTLS — Port 143

Capabilities sometimes change after TLS negotiation. Compare pre and post-STARTTLS output:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -starttls imap -connect $TARGET_IP:143 -crlf -quiet 2>/dev/null 
* OK Dovecot ready.
* CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN AUTH=NTLM

AUTH=NTLM appearing only after STARTTLS but not before confirms the server correctly withholds auth options until TLS is established. If AUTH methods appear on port 143 before STARTTLS, that is a misconfiguration — covered in weak authentication testing.

TLS Certificate — Port 993

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:993 2>/dev/null | grep -iE 'subject|DNS:' 
subject=CN=mail.company.com
DNS:mail.company.com, DNS:imap.company.com, DNS:autodiscover.company.com
┌──(kali㉿kali)-[~]
└─$ printf 'z1 CAPABILITY\r\nz2 LOGOUT\r\n' | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null 
* OK Dovecot ready.
* CAPABILITY IMAP4rev1 SASL-IR ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN AUTH=NTLM AUTH=SCRAM-SHA-256

Username Validity Testing

IMAP response differences between unknown users and wrong passwords reveal whether user enumeration is possible. Compare responses carefully — timing and exact error text differ between implementations:

┌──(kali㉿kali)-[~]
└─$ printf 'a1 LOGIN doesnotexist123 boguspass\r\na2 LOGOUT\r\n' | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -E 'a1|NO|BAD' 
a1 NO [AUTHENTICATIONFAILED] Authentication failed.
┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER boguspass\r\na2 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -E 'a1|NO|BAD' 
a1 NO [AUTHENTICATIONFAILED] Authentication failed.

Identical responses mean user enumeration via IMAP is not reliable on this server. Pivot to SMTP user enumeration or LDAP for user discovery. Different response text or timing differences confirm enumeration is possible.

Mailbox Enumeration with Valid Credentials

Use EXAMINE instead of SELECT to avoid marking messages as read. EXAMINE is read-only and leaves no trace in the mailbox state:

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 LIST \"\" \"*\"\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null 
a1 OK Logged in.
* LIST (\HasNoChildren) "." INBOX
* LIST (\HasNoChildren) "." Sent
* LIST (\HasNoChildren) "." Drafts
* LIST (\HasNoChildren) "." Trash
* LIST (\HasNoChildren) "." Archives
a2 OK List completed.
┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 STATUS INBOX (MESSAGES UNSEEN RECENT)\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null 
a1 OK Logged in.
* 47 EXISTS
* 0 RECENT
a2 OK [READ-ONLY] Examine completed.
* STATUS INBOX (MESSAGES 47 UNSEEN 12 RECENT 0)
a3 OK Status completed.

47 messages with 12 unseen in INBOX. Move to mailbox data harvesting to triage and extract high-value content. Move to credential attacks when you need access without existing credentials.

References