Enumeration

POP3 enumeration starts with the service banner, which often leaks the mail server software and version. From there, the CAPA command lists supported capabilities and authentication mechanisms, showing whether the server supports STLS, APOP, or plaintext-only login.

USER and PASS commands can probe for valid accounts without full authentication on misconfigured servers. STAT and LIST reveal mailbox size and message counts once access is gained, useful for gauging how much data you can pull during exploitation.

Nmap service scripts, Netcat, and Telnet handle most POP3 enumeration. Check for servers running on both port 110 (plaintext) and 995 (TLS) since configuration often differs between them.