# POP3 Enumeration

- **URL:** https://hackindex.io/services/pop3/enumeration/pop3-enumeration
- **Path:** POP3 > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/pop3/enumeration.md)
- **Published:** 2026-01-18
- **Updated:** 2026-03-29

POP3 enumeration extracts server version, supported capabilities, authentication mechanisms, and NTLM metadata. Port 110 is plaintext POP3 unless upgraded with STLS. Port 995 uses implicit TLS. Always compare both ports: authentication mechanisms and CAPA output sometimes differ between them, and 110 without STLS exposes credentials in transit. With valid credentials, mailbox metadata and message content become accessible.

- Service Discovery
- Capability and NTLM Enumeration
- Banner Grab and CAPA: Port 110
- TLS Certificate: Port 995
- Mailbox Enumeration with Valid Credentials
- Read Message Headers Without Full Download

## Service Discovery

```bash
nmap -sV -p 110,995 $TARGET_IP
# 110/tcp open  pop3    Dovecot pop3d
# 995/tcp open  ssl/pop3 Dovecot pop3d
```

## Capability and NTLM Enumeration

```bash
nmap -p 110,995 --script pop3-capabilities,pop3-ntlm-info $TARGET_IP
# | pop3-capabilities:
# |   CAPA
# |   SASL PLAIN LOGIN
# |   STLS
# |   UIDL
# |   TOP
# | pop3-ntlm-info:
# |   Target_Name: COMPANY
# |   NetBIOS_Domain_Name: COMPANY
# |   DNS_Domain_Name: company.local
# |   DNS_Computer_Name: mail01.company.local
# |_  Product_Version: 10.0.17763
```

NTLM info reveals domain name, hostname, and Windows version without credentials: immediately useful for AD targeting and password spraying scope. SASL PLAIN and LOGIN on port 110 without STLS means credentials are sent in plaintext. STLS in the CAPA output means TLS upgrade is available but not enforced.

## Banner Grab and CAPA: Port 110

```bash
echo -e 'CAPA\nQUIT' | nc -nv $TARGET_IP 110
# +OK Dovecot ready.
# +OK
# CAPA
# SASL PLAIN LOGIN
# STLS
# UIDL
# TOP
# RESP-CODES
# .
```

## TLS Certificate: Port 995

Pull the certificate from port 995 and check SANs for internal hostnames:

```bash
openssl s_client -connect $TARGET_IP:995 -crlf 2>/dev/null | grep -iE 'subject|DNS:'
# subject=CN=mail.company.com
# DNS:mail.company.com, DNS:pop3.company.com, DNS:autodiscover.company.com
```

```bash
echo -e 'CAPA\nQUIT' | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null
# +OK Dovecot ready.
# +OK
# CAPA
# SASL PLAIN LOGIN NTLM
# UIDL
# TOP
# .
```

## Mailbox Enumeration with Valid Credentials

Once credentials are available from brute force or other sources, connect and pull mailbox metadata before reading any messages:

```bash
echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nLIST\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null
# +OK Dovecot ready.
# +OK
# +OK 14 messages (42560 octets)
# +OK 14 messages (42560 octets)
# 1 3200
# 2 1800
# 3 8960
# ...
```

STAT returns the message count and total mailbox size. LIST gives per-message sizes: larger messages often contain attachments. Use UIDL for stable message IDs that persist across sessions.

## Read Message Headers Without Full Download

TOP retrieves the headers plus a specified number of body lines. Use this to triage content before pulling full messages:

```bash
echo -e "USER $USER\nPASS $PASSWORD\nTOP 1 0\nTOP 2 0\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null
# +OK
# From: IT Support <support@company.com>
# To: john.smith@company.com
# Subject: Your temporary password is ready
# Date: Mon, 28 Mar 2026 09:00:00 +0000
#
# .
```

Headers alone often reveal password reset emails, MFA codes, VPN links, and internal system references. Pull full message bodies only when headers indicate high-value content:

```bash
echo -e "USER $USER\nPASS $PASSWORD\nRETR 1\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null
```

> [!CAUTION]
> DELE marks messages for deletion. Never use it during enumeration. If accidentally used, RSET clears all deletions before QUIT is sent.

Move to [weak authentication testing](https://hackindex.io/services/pop3/vulnerability-discovery/pop3-weak-authentication) to assess TLS enforcement, and to [credential attacks](https://hackindex.io/services/pop3/exploitation/pop3-credential-attacks) when you need to gain access without existing credentials.

## References

- [nmap: pop3-capabilities NSE](https://nmap.org/nsedoc/scripts/pop3-capabilities.html) - CAPA and SASL mechanism enumeration
- [nmap: pop3-ntlm-info NSE](https://nmap.org/nsedoc/scripts/pop3-ntlm-info.html) - NTLM metadata extraction from Exchange POP3