pentesting-pop3

name	pentesting-pop3
description	Testing POP3 services (default ports 110 cleartext, 995 POP3S) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox retrieval/data extraction via raw POP3 commands during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","pop3"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting POP3 (ports 110, 995)

When to Use

• Default ports: 110/tcp (cleartext POP3) and 995/tcp (POP3 over TLS / POP3S).
• When nmap/banner shows pop3, a +OK ... POP3 server greeting, or Dovecot/JAMES/Exchange POP3.
• For credential testing and post-auth mailbox retrieval (downloaded mail commonly holds reusable secrets).

Quick Enumeration

# Cleartext banner
nc -nv <IP> 110

# POP3S banner
openssl s_client -connect <IP>:995 -crlf -quiet

# Capabilities + NTLM info (default scripts)
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p 110,995 <IP>

# Shodan-style discovery marker
#   port:110

Critical: Checks Most Often Missed

• Cleartext credentials on 110 — USER/PASS over port 110 (no STLS) is sniffable.
  • How to CONFIRM: capture with tcpdump -i eth0 -A 'tcp port 110' and observe USER/PASS; check CAPA for STLS and SASL support.
• NTLM info disclosure — AUTH NTLM leaks Windows/domain build info on Exchange.
  • How to CONFIRM: nmap -p110 --script pop3-ntlm-info <IP>.
• Weak/default credentials — guessable or reused mailbox passwords; brute-forceable.
  • How to CONFIRM: hydra -l <user> -P passwords.txt -f <IP> pop3 -V returns a valid login.
• Authenticated mailbox data exposure — RETR downloads full message bodies that frequently contain plaintext credentials, RDP/SSH logins, and internal hostnames.
  • How to CONFIRM: log in, LIST, then RETR 1 and read the body.
• Verbose auth logging — Dovecot with auth_debug_passwords/auth_verbose_passwords = true writes passwords to logs in cleartext (note for post-exploitation log review).

Workflow

Step 1: Enumerate (capabilities, version, NTLM)

nc -nv <IP> 110
openssl s_client -connect <IP>:995 -crlf -quiet
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p 110,995 <IP>
# Manual capability listing once connected:
CAPA
msfconsole -q -x 'use auxiliary/scanner/pop3/pop3_version; set RHOSTS <IP>; set RPORT 110; run; exit'

Step 2: Authenticate (default creds, brute force)

# Brute force
hydra -l <Username> -P passwords.txt -f <IP> pop3 -V
hydra -l <Username> -P passwords.txt -f pop3s://<IP>
nxc pop3 <IP> -u users.txt -p passwords.txt

# Manual login (cleartext)
nc -nv <IP> 110
USER billydean
PASS password

Step 3: Exploit / Extract (retrieve mailbox)

# Raw POP3 command flow after login
STAT          # number of messages + total mailbox size
LIST          # message numbers and sizes
RETR 1        # download (show) message 1 — read for credentials/secrets
TOP 1 10      # first 10 lines of message 1 (peek without full download)
DELE 1        # mark for deletion (avoid in engagements unless authorized)
RSET          # undo deletions
QUIT          # logout (expunges if no RSET)

Example session:

+OK beta POP3 server (JAMES POP3 Server 2.3.2) ready
USER billydean
+OK
PASS password
+OK Welcome billydean
LIST
+OK 2 1807
RETR 1
+OK Message follows
... username: billydean  password: PA$$W0RD!Z ...

Step 4: Post-access / pivot

• Grep retrieved messages for credentials, password-reset links, and internal hostnames/IPs.
• Reuse harvested credentials against IMAP/SMTP/OWA/SSH/VPN; map topology from headers.
• During post-exploitation, review Dovecot logs if auth_*_passwords were enabled — plaintext passwords may be present.

Key Concepts

Concept	Description
POP3 model	Connect, download all messages locally, then (typically) delete them from the server.
CAPA	Lists server capabilities (STLS, SASL, UIDL, TOP, USER).
Cleartext exposure	USER/PASS on 110 without STLS sends credentials in plaintext.
NTLM disclosure	AUTH NTLM on Exchange leaks NetBIOS/DNS/OS build.
RETR/TOP extraction	Authenticated commands pull message bodies that often contain secrets.
Verbose log leak	auth_debug_passwords/auth_verbose_passwords can log cleartext passwords.

Tools & Systems

Tool	Purpose
nmap NSE	pop3-capabilities, pop3-ntlm-info.
nc / openssl s_client	Banner grab, manual cleartext/TLS POP3 sessions.
hydra / netexec (nxc)	Credential brute force / spraying.
Metasploit	scanner/pop3/pop3_version.
tcpdump / Wireshark	Capture cleartext credentials on port 110.

Common Scenarios

Scenario 1: Cleartext POP3 credential capture

Port 110 lacks STLS. A MitM + tcpdump 'tcp port 110' captures USER/PASS in plaintext, reused on the mail web portal.

Scenario 2: Brute force → credential reuse

hydra <IP> pop3 finds billydean:PA$$W0RD!Z. RETR 1 reveals an email containing RDP credentials, enabling lateral movement to a workstation.

Scenario 3: Exchange NTLM disclosure

nmap -p110 --script pop3-ntlm-info returns NetBIOS name, domain, and OS build, supporting AD reconnaissance.

Output Format

## POP3 Finding

**Service**: POP3
**Port**: 110/tcp (Dovecot, STLS not enforced)
**Severity**: High
**Finding**: Cleartext authentication + weak credentials with sensitive mailbox content
**Evidence**:
  - CAPA showed no STLS enforcement; tcpdump captured "PASS PA$$W0RD!Z"
  - RETR 1 returned an email containing RDP credentials
**Impact**: Credentials are exposed on the wire and downloaded mail discloses additional secrets enabling lateral movement.
**Recommendation**:
  1. Enforce TLS (require STLS or POP3S only; disable plaintext auth on 110).
  2. Enforce strong, unique mailbox passwords and rate-limit auth.
  3. Disable `auth_debug_passwords`/`auth_verbose_passwords`; advise users not to store credentials in email.