# Pop3 Pentesting

> How to enumerate, test, and exploit POP3 mail servers during security assessments. Use this skill whenever the user mentions POP3, port 110, port 995, email server testing, mail server enumeration, or any task related to testing Post Office Protocol services. This includes banner grabbing, capability enumeration, brute force attacks, and identifying misconfigurations that expose credentials.

- Skill: `abelrguezr/pop3-pentesting` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/pop3-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/pop3-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/pop3-pentesting

---


# POP3 Pentesting Skill

A comprehensive guide for testing Post Office Protocol (POP3) mail servers during security assessments.

## Quick Reference

| Port | Service | Protocol |
|------|---------|----------|
| 110 | POP3 | Unencrypted |
| 995 | POP3S | SSL/TLS Encrypted |

## Enumeration

### Banner Grabbing

Start by connecting to the POP3 service to identify the server software and version:

**Unencrypted (port 110):**
```bash
nc -nv <target-ip> 110
```

**Encrypted (port 995):**
```bash
openssl s_client -connect <target-ip>:995 -crlf -quiet
```

**Using the bundled script:**
```bash
./scripts/banner_grab.sh <target-ip> [port]
```

### Nmap Scanning

Run Nmap with POP3-specific scripts to enumerate capabilities and detect NTLM authentication:

```bash
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p 110,995 <target-ip>
```

**Using the bundled script:**
```bash
./scripts/nmap_pop3_scan.sh <target-ip>
```

The `pop3-ntlm-info` script can reveal sensitive Windows version information.

### Metasploit Enumeration

Quick version enumeration without launching the full console:

```bash
msfconsole -q -x 'use auxiliary/scanner/pop3/pop3_version; set RHOSTS <target-ip>; set RPORT 110; run; exit'
```

## Manual POP3 Commands

Connect via telnet or netcat and use these commands:

| Command | Description |
|---------|-------------|
| `USER <username>` | Log in as specified user |
| `PASS <password>` | Provide password |
| `STAT` | List message count and mailbox size |
| `LIST` | List all messages with sizes |
| `RETR <n>` | Retrieve message number n |
| `DELE <n>` | Mark message n for deletion |
| `RSET` | Reset/undo changes |
| `QUIT` | Logout (deletes marked messages) |
| `TOP <msg> <n>` | Show first n lines of message |
| `CAPA` | Get server capabilities |

### Example Session

```
telnet <target-ip> 110
+OK beta POP3 server (JAMES POP3 Server 2.3.2) ready

USER billydean
+OK

PASS password
+OK Welcome billydean

LIST
+OK 2 1807
1 786
2 1021

RETR 1
+OK Message follows
From: jamesbrown@motown.com
Dear Billy Dean,

Here is your login for remote desktop ... try not to forget it this time!
username: billydean
password: PA$$W0RD!
```

## Brute Force Attacks

### Using Hydra

When you have a username and password list:

```bash
hydra -l <username> -P <password-list> -f <target-ip> pop3 -V
```

**Parameters:**
- `-l`: Single username
- `-P`: Password list file
- `-f`: Stop on first success
- `-V`: Verbose output

### Using Metasploit

```bash
msfconsole
use auxiliary/scanner/pop3/pop3_login
set RHOSTS <target-ip>
set RPORT 110
set USER_FILE /path/to/users.txt
set PASS_FILE /path/to/passwords.txt
run
```

## Common Vulnerabilities

### Password Logging Misconfigurations

Some POP3 servers log passwords in cleartext when debug settings are enabled:

- `auth_debug` - Increases log verbosity
- `auth_debug_passwords` - Logs passwords in cleartext
- `auth_verbose_passwords` - Verbose password logging

**Check server logs** if you gain access to the mail server filesystem:

```bash
grep -i "password" /var/log/mail.log
grep -i "auth" /var/log/mail.log
```

### Weak Credentials

POP3 servers often have:
- Default credentials
- Weak passwords
- Reused credentials from other services

### Information Disclosure

Email messages may contain:
- Credentials for other systems
- Sensitive business information
- Internal network details

## Workflow

1. **Reconnaissance**: Identify POP3 services on target
2. **Banner Grabbing**: Determine server software and version
3. **Capability Enumeration**: Use CAPA command and Nmap scripts
4. **Credential Testing**: Attempt known credentials or brute force
5. **Message Analysis**: Review retrieved emails for sensitive data
6. **Log Analysis**: Check for password logging misconfigurations

## Safety Notes

- Always obtain proper authorization before testing
- POP3 credentials may grant access to sensitive email data
- Some brute force attempts may trigger account lockouts
- Document all findings for the security assessment report

## Bundled Scripts

See the `scripts/` directory for:
- `banner_grab.sh` - Automated banner grabbing
- `nmap_pop3_scan.sh` - Nmap scanning wrapper
- `pop3_enum.sh` - Comprehensive enumeration helper