Exploitation

POP3 exploitation typically centers on credential access. Hydra and Medusa brute-force USER/PASS combinations efficiently, especially when you have a username list from earlier enumeration. Weak or default credentials on internal mail servers are more common than you would expect.

Servers running POP3 on port 110 without STLS transmit credentials in plaintext, making packet capture with Wireshark or tcpdump a reliable way to harvest them on a shared network segment. Once authenticated, RETR downloads individual messages that often contain passwords, internal URLs, tokens, and sensitive attachments.

Mailbox access is valuable beyond the emails themselves. Password reset links, MFA backup codes, and internal system notifications frequently sit in inboxes waiting to be pulled.