~/service-imap

IMAP

CPTS Notes2 min read
CPTS Notes
  1. Start Here
  2. General Framework
  3. Enumeration
  4. Enumeration with Nmap
  5. Services
  6. FTP
  7. SMB
  8. NFS
  9. DNS
  10. SMTP
  11. IMAP
  12. POP3
  13. Reference
  14. Port References
  15. Linux Commands Cheatsheet
  16. DNS Resolution
  17. The Mail Pipeline
  18. SMB & NetBIOS
On this page
  1. TL;DR
  2. Commands
  3. Enumeration
  4. Common misconfigurations
  5. Attack playbook
  6. Practice boxes

TL;DR

IMAP (Internet Message Access Protocol). Reads mail that stays on the server, with folders and multi-client sync. TCP 143 (plaintext or STARTTLS), 993 (implicit TLS). Cleartext without TLS, so credentials and mail are sniffable. POP3 is the download-and-delete alternative, covered in POP3.

First checks: the banner and certificate (hostname, org, admin email), plaintext auth, and whether found credentials log in.

How mail moves is in The Mail Pipeline.

Commands

IMAP tags each command with an identifier such as a.

Command Does
a LOGIN user pass Authenticate.
a LIST "" * List every folder.
a LSUB "" * List subscribed folders.
a SELECT INBOX Open a mailbox.
a FETCH <id> all Read a message.
a LOGOUT Close the session.

Enumeration

Sweep.

sudo nmap -p143,993 -sV -sC $TARGET

-sC runs imap-capabilities and ssl-cert. The certificate leaks the hostname, organization, and an admin email.

Interact.

openssl s_client -connect $TARGET:imaps
curl -k "imaps://$TARGET" --user '<user>:<pass>'

openssl s_client -connect :imaps opens a TLS session to 993. curl --user logs in and lists the folders. For plaintext 143, use nc -nv $TARGET 143.

Common misconfigurations

  • Plaintext auth without STARTTLS, so credentials are sniffable.
  • Anonymous login.
  • Verbose auth logging that records passwords.
  • Reused credentials from another service.

Attack playbook

IMAP is for reading mail, not a daemon exploit.

  1. Log in with found credentials. Credentials from SMTP enumeration, a config, or reuse often work here. Mail holds credentials, password resets, and internal detail.
  2. Read every folder. LIST "" *, then SELECT and FETCH. Folder names are case-sensitive, and the useful mail is often outside INBOX.
  3. Sniff plaintext. On port 143 without TLS, credentials and mail cross the wire in clear.

Practice boxes

Box Difficulty IMAP’s role
Mailing Easy A cracked hMailServer admin password logs into the mailbox to read mail.

IMAP rarely falls on its own. The win is logging in with found or reused credentials and reading the mail.