POP3

POP3 (Post Office Protocol version 3) retrieves email from a mail server, running on TCP port 110 (plaintext) and TCP port 995 (POP3S with TLS). Nmap identifies them as pop3 and pop3s. Common POP3 servers include Dovecot, Courier, and Cyrus.

POP3 on port 110 transmits credentials in plaintext, making them easy to intercept on a shared network. Weak or reused passwords are common, and successful login grants access to a user's mailbox. Emails often contain sensitive information: credentials, password reset links, internal documents, and infrastructure details.

Grab the banner to identify the server software and version. Attempt login with known or guessed credentials. If access is gained, download and review stored messages for useful data. Nmap's pop3-capabilities and pop3-ntlm-info scripts can extract additional details.