Skip to content
HackIndex logo

HackIndex

POP3 Enumeration

3 min read Mar 29, 2026

POP3 enumeration extracts server version, supported capabilities, authentication mechanisms, and NTLM metadata. Port 110 is plaintext POP3 unless upgraded with STLS. Port 995 uses implicit TLS. Always compare both ports — authentication mechanisms and CAPA output sometimes differ between them, and 110 without STLS exposes credentials in transit. With valid credentials, mailbox metadata and message content become accessible.

Service Discovery

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 110,995 $TARGET_IP 
110/tcp open  pop3    Dovecot pop3d
995/tcp open  ssl/pop3 Dovecot pop3d

Capability and NTLM Enumeration

┌──(kali㉿kali)-[~]
└─$ nmap -p 110,995 --script pop3-capabilities,pop3-ntlm-info $TARGET_IP 
| pop3-capabilities:
|   CAPA
|   SASL PLAIN LOGIN
|   STLS
|   UIDL
|   TOP
| pop3-ntlm-info:
|   Target_Name: COMPANY
|   NetBIOS_Domain_Name: COMPANY
|   DNS_Domain_Name: company.local
|   DNS_Computer_Name: mail01.company.local
|_  Product_Version: 10.0.17763

NTLM info reveals domain name, hostname, and Windows version without credentials — immediately useful for AD targeting and password spraying scope. SASL PLAIN and LOGIN on port 110 without STLS means credentials are sent in plaintext. STLS in the CAPA output means TLS upgrade is available but not enforced.

┌──(kali㉿kali)-[~]
└─$ echo -e 'CAPA\nQUIT' | nc -nv $TARGET_IP 110 
+OK Dovecot ready.
+OK
CAPA
SASL PLAIN LOGIN
STLS
UIDL
TOP
RESP-CODES
.

TLS Certificate — Port 995

Pull the certificate from port 995 and check SANs for internal hostnames:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:995 -crlf 2>/dev/null | grep -iE 'subject|DNS:' 
subject=CN=mail.company.com
DNS:mail.company.com, DNS:pop3.company.com, DNS:autodiscover.company.com
┌──(kali㉿kali)-[~]
└─$ echo -e 'CAPA\nQUIT' | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null 
+OK Dovecot ready.
+OK
CAPA
SASL PLAIN LOGIN NTLM
UIDL
TOP
.

Mailbox Enumeration with Valid Credentials

Once credentials are available from brute force or other sources, connect and pull mailbox metadata before reading any messages:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nLIST\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null 
+OK Dovecot ready.
+OK
+OK 14 messages (42560 octets)
+OK 14 messages (42560 octets)
1 3200
2 1800
3 8960
...

STAT returns the message count and total mailbox size. LIST gives per-message sizes — larger messages often contain attachments. Use UIDL for stable message IDs that persist across sessions.

Read Message Headers Without Full Download

TOP retrieves the headers plus a specified number of body lines. Use this to triage content before pulling full messages:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nTOP 1 0\nTOP 2 0\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null 
+OK
From: IT Support <[email protected]>
To: [email protected]
Subject: Your temporary password is ready
Date: Mon, 28 Mar 2026 09:00:00 +0000

.

Headers alone often reveal password reset emails, MFA codes, VPN links, and internal system references. Pull full message bodies only when headers indicate high-value content:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nRETR 1\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null

Move to weak authentication testing to assess TLS enforcement, and to credential attacks when you need to gain access without existing credentials.

References