> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/pop3.md).

# POP3

**POP3** is a protocol used by email clients to retrieve messages from a remote mail server. 

***

### Default POP3 Ports

| Port | Protocol | Description           |
| ---- | -------- | --------------------- |
| 110  | TCP      | POP3 (plain-text)     |
| 995  | TCP      | POP3 over SSL (POP3S) |

***

### Service Detection

Check if the POP3 port is open and identify service details:

```bash
nmap -sV -p 110,995 <target-ip>
```

To manually banner grab:

```bash
nc <target-ip> 110
```

You may get a response like:

```
+OK Dovecot ready.
```

***

### Manual POP3 Interaction

```bash
telnet <target-ip> 110
```

Basic Commands:

```bash
USER <username>
PASS <password>
LIST            # Lists all available messages
RETR <msg-id>   # Retrieves the message content
QUIT            # Closes the connection
```

Example:

```bash
USER test
+OK
PASS test123
+OK Logged in.
LIST
RETR 1
QUIT
```

***

### Nmap Scripts for POP3

```bash
nmap -p 110 --script=pop3-capabilities,pop3-brute,pop3-ntlm-info <target-ip>
```

| Script              | Description                                 |
| ------------------- | ------------------------------------------- |
| `pop3-capabilities` | Lists server-supported capabilities         |
| `pop3-brute`        | Performs brute-force authentication         |
| `pop3-ntlm-info`    | Extracts NTLM information from POP3 servers |

***

### Brute-force Attacks

Use **Hydra** to attempt password cracking:

```bash
hydra -l <username> -P /usr/share/wordlists/rockyou.txt <target-ip> pop3
```

For SSL-encrypted POP3 (port 995):

```bash
hydra -l <username> -P /usr/share/wordlists/rockyou.txt -s 995 <target-ip> pop3s
```