# IMAP enumeration

- **URL:** https://hackindex.io/services/imap/enumeration/imap-enumeration
- **Path:** IMAP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/imap/enumeration.md)
- **Published:** 2026-01-18
- **Updated:** 2026-03-29

IMAP enumeration extracts server capabilities, authentication mechanisms, NTLM metadata, and TLS configuration from ports 143 and 993. Port 143 is plaintext IMAP unless upgraded with STARTTLS. Port 993 uses implicit TLS. The CAPABILITY response on each port often differs: AUTH methods are sometimes only advertised after TLS negotiation, and LOGINDISABLED on port 143 confirms whether the server enforces TLS before login. With valid credentials, IMAP provides richer mailbox access than POP3 through folder enumeration, server-side search, and non-destructive read-only selection via EXAMINE.

- Service Discovery
- Capability and NTLM Enumeration
- Manual CAPABILITY: Port 143
- CAPABILITY After STARTTLS: Port 143
- TLS Certificate: Port 993
- Username Validity Testing
- Mailbox Enumeration with Valid Credentials

## Service Discovery

```bash
nmap -sV -p 143,993 $TARGET_IP
# 143/tcp open  imap    Dovecot imapd
# 993/tcp open  ssl/imap Dovecot imapd
```

## Capability and NTLM Enumeration

```bash
nmap -p 143,993 --script imap-capabilities,imap-ntlm-info $TARGET_IP
# | imap-capabilities:
# |   IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
# |   STARTTLS LOGINDISABLED AUTH=PLAIN AUTH=LOGIN
# | imap-ntlm-info:
# |   Target_Name: COMPANY
# |   NetBIOS_Domain_Name: COMPANY
# |   DNS_Domain_Name: company.local
# |   DNS_Computer_Name: mail01.company.local
# |_  Product_Version: 10.0.17763
```

`LOGINDISABLED` on port 143 confirms the server blocks LOGIN before STARTTLS: this is correct behavior. Its absence means plaintext login is accepted. NTLM info reveals domain, hostname, and Windows version without credentials: immediately useful for AD targeting.

## Manual CAPABILITY: Port 143

```bash
printf 'a0 CAPABILITY\r\na1 LOGOUT\r\n' | nc -nv $TARGET_IP 143
# * OK Dovecot ready.
# * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS STARTTLS LOGINDISABLED AUTH=PLAIN
# a0 OK Pre-login capabilities listed.
# * BYE Logging out
# a1 OK Logout completed.
```

## CAPABILITY After STARTTLS: Port 143

Capabilities sometimes change after TLS negotiation. Compare pre and post-STARTTLS output:

```bash
openssl s_client -starttls imap -connect $TARGET_IP:143 -crlf -quiet 2>/dev/null
# * OK Dovecot ready.
# * CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN AUTH=NTLM
```

AUTH=NTLM appearing only after STARTTLS but not before confirms the server correctly withholds auth options until TLS is established. If AUTH methods appear on port 143 before STARTTLS, that is a misconfiguration: covered in [weak authentication testing](https://hackindex.io/services/imap/vulnerability-discovery/imap-weak-authentication).

## TLS Certificate: Port 993

```bash
openssl s_client -connect $TARGET_IP:993 2>/dev/null | grep -iE 'subject|DNS:'
# subject=CN=mail.company.com
# DNS:mail.company.com, DNS:imap.company.com, DNS:autodiscover.company.com
```

```bash
printf 'z1 CAPABILITY\r\nz2 LOGOUT\r\n' | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null
# * OK Dovecot ready.
# * CAPABILITY IMAP4rev1 SASL-IR ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN AUTH=NTLM AUTH=SCRAM-SHA-256
```

## Username Validity Testing

IMAP response differences between unknown users and wrong passwords reveal whether user enumeration is possible. Compare responses carefully: timing and exact error text differ between implementations:

```bash
printf 'a1 LOGIN doesnotexist123 boguspass\r\na2 LOGOUT\r\n' | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -E 'a1|NO|BAD'
# a1 NO [AUTHENTICATIONFAILED] Authentication failed.
```

```bash
printf "a1 LOGIN $USER boguspass\r\na2 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -E 'a1|NO|BAD'
# a1 NO [AUTHENTICATIONFAILED] Authentication failed.
```

Identical responses mean user enumeration via IMAP is not reliable on this server. Pivot to [SMTP user enumeration](https://hackindex.io/services/smtp/vulnerability-discovery/smtp-user-enumeration) or LDAP for user discovery. Different response text or timing differences confirm enumeration is possible.

## Mailbox Enumeration with Valid Credentials

Use EXAMINE instead of SELECT to avoid marking messages as read. EXAMINE is read-only and leaves no trace in the mailbox state:

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 LIST \"\" \"*\"\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null
# a1 OK Logged in.
# * LIST (\HasNoChildren) "." INBOX
# * LIST (\HasNoChildren) "." Sent
# * LIST (\HasNoChildren) "." Drafts
# * LIST (\HasNoChildren) "." Trash
# * LIST (\HasNoChildren) "." Archives
# a2 OK List completed.
```

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 STATUS INBOX (MESSAGES UNSEEN RECENT)\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null
# a1 OK Logged in.
# * 47 EXISTS
# * 0 RECENT
# a2 OK [READ-ONLY] Examine completed.
# * STATUS INBOX (MESSAGES 47 UNSEEN 12 RECENT 0)
# a3 OK Status completed.
```

47 messages with 12 unseen in INBOX. Move to [mailbox data harvesting](https://hackindex.io/services/imap/exploitation/imap-mailbox-data-harvesting) to triage and extract high-value content. Move to [credential attacks](https://hackindex.io/services/imap/exploitation/imap-credential-attacks) when you need access without existing credentials.

## References

- [nmap: imap-capabilities NSE](https://nmap.org/nsedoc/scripts/imap-capabilities.html) - CAPABILITY and auth mechanism enumeration
- [nmap: imap-ntlm-info NSE](https://nmap.org/nsedoc/scripts/imap-ntlm-info.html) - NTLM metadata extraction from Exchange IMAP