~/service-pop3

POP3

CPTS Notes2 min read
CPTS Notes
  1. Start Here
  2. General Framework
  3. Enumeration
  4. Enumeration with Nmap
  5. Services
  6. FTP
  7. SMB
  8. NFS
  9. DNS
  10. SMTP
  11. IMAP
  12. POP3
  13. Reference
  14. Port References
  15. Linux Commands Cheatsheet
  16. DNS Resolution
  17. The Mail Pipeline
  18. SMB & NetBIOS
On this page
  1. TL;DR
  2. Commands
  3. Enumeration
  4. Common misconfigurations
  5. Attack playbook
  6. Practice boxes

TL;DR

POP3 (Post Office Protocol v3). Downloads mail from a server, classically deleting it after. No folders and no server-side management, which is what IMAP adds. TCP 110 (plaintext or STARTTLS), 995 (implicit TLS). Cleartext without TLS.

First checks: the banner and certificate (hostname, org, admin email), plaintext auth, and whether found credentials log in.

How mail moves is in The Mail Pipeline.

Commands

Command Does
USER <name> Name the user.
PASS <pass> Authenticate.
STAT Count the messages.
LIST List messages and sizes.
RETR <id> Read a message.
DELE <id> Delete a message.
QUIT Close the session.

Enumeration

Sweep.

sudo nmap -p110,995 -sV -sC $TARGET

-sC runs pop3-capabilities and ssl-cert. The certificate leaks the hostname, organization, and an admin email.

Interact.

openssl s_client -connect $TARGET:pop3s

:pop3s opens a TLS session to 995. For plaintext 110, use nc -nv $TARGET 110, then USER and PASS. Read messages with RETR.

Common misconfigurations

  • Plaintext auth without STARTTLS, so credentials are sniffable.
  • Anonymous login.
  • Verbose auth logging that records passwords.
  • Reused credentials from another service.

Attack playbook

POP3 is for reading mail.

  1. Log in with found credentials. From SMTP enumeration, a config, or reuse.
  2. Download the mail. STAT, LIST, then RETR <id>. Hunt for credentials, password resets, and internal hosts.
  3. Sniff plaintext. On port 110 without TLS, credentials and mail cross the wire in clear.

Practice boxes

Box Difficulty POP3’s role
SolidState Easy Apache James admin resets a mailbox password, then read it over POP3 for credentials.

POP3 is a mailbox reader. The win is credentials in, mail out.