# POP3

> Email retrieval protocol downloading messages locally.

- **URL:** https://hackindex.io/services/pop3
- **Type:** Service
- **Default ports:** 110, 995
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

POP3 (Post Office Protocol version 3) retrieves email from a mail server, running on **TCP port 110** (plaintext) and **TCP port 995** (POP3S with TLS). Nmap identifies them as `pop3` and `pop3s`. Common POP3 servers include Dovecot, Courier, and Cyrus.

POP3 on port 110 transmits credentials in plaintext, making them easy to intercept on a shared network. Weak or reused passwords are common, and successful login grants access to a user's mailbox. Emails often contain sensitive information: credentials, password reset links, internal documents, and infrastructure details.

Grab the banner to identify the server software and version. Attempt login with known or guessed credentials. If access is gained, download and review stored messages for useful data. Nmap's `pop3-capabilities` and `pop3-ntlm-info` scripts can extract additional details.

## Phases

- [Enumeration](https://hackindex.io/services/pop3/enumeration.md): Enumerate POP3 via banners, CAPA, NTLM, and auth checks (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/pop3/vulnerability-discovery.md): Guides for finding POP3 auth weaknesses and TLS misconfigs (1 guides)
- [Exploitation](https://hackindex.io/services/pop3/exploitation.md): Brute force POP3 logins and harvest mailbox data post-auth (2 guides)