# Vulnerability Discovery

> Guides for finding POP3 auth weaknesses and TLS misconfigs

- **URL:** https://hackindex.io/services/pop3/vulnerability-discovery
- **Service:** [POP3](https://hackindex.io/services/pop3.md)
- **Tags:** vulns, misconfig, risk
- **Published:** 2026-03-29
- **Updated:** 2026-03-29

POP3 vulnerability discovery focuses on authentication and transport weaknesses. The biggest issue is plaintext authentication over port 110 without STLS support, which exposes credentials to anyone sniffing the wire. Check CAPA output for STLS and try STARTTLS to see if encryption is actually available or just advertised.

Missing or optional STLS means the server accepts credentials in the clear even when a TLS-wrapped port (995) exists alongside it. Weak credential policies compound this: no lockout after failed attempts, acceptance of short passwords, and default accounts that were never disabled.

Older POP3 implementations may also be vulnerable to buffer overflows or format string bugs in the authentication handling. Cross-reference the server version from the banner against CVE databases and Exploit-DB for known issues.

## Guides

- [POP3 Weak Authentication Testing](https://hackindex.io/services/pop3/vulnerability-discovery/pop3-weak-authentication.md)