IMAP / POP3 Enumeration

IMAP and POP3 are the two classic mail-retrieval protocols. POP3 only lists, downloads, and deletes messages; IMAP manages the mailbox on the server with folders and synchronization across clients. For a pentester, a self-hosted mail server (instead of an external provider) is a goldmine: a misconfiguration can let you read other people's mail, which often contains credentials, internal information, or the next step in the chain.

Mechanism

The ports are 110 (POP3) and 143 (IMAP) in cleartext, and 995/993 over TLS. A scripted version scan reveals the software (for example Dovecot) and its capabilities:

nmap -sV -sC -p110,143,993,995 <ip>

Both protocols are text-based, so you interact by hand. For IMAP over TLS, reach for openssl s_client or curl:

openssl s_client -connect <ip>:imaps
curl -k 'imaps://<ip>' --user <user>:<pass>

Once inside, IMAP commands navigate the mailbox (1 LOGIN <user> <pass>, 1 LIST "" * to see folders, 1 SELECT INBOX, 1 FETCH <ID> all to read a message). In POP3 the flow is USER <user> / PASS <pass>, LIST to see how many mails exist, and RETR <ID> to download them.

Requirements

Port and version enumeration needs nothing; reading mail requires credentials, barring insecure configurations. Dovecot, for example, has options such as auth_anonymous_username (FTP-style anonymous login) or auth_debug_passwords (logs passwords), which a careless administrator may leave enabled and hand over access or credentials.

How to detect it

From the defensive side, an enumeration attempt is given away by: many failed LOGIN/USER attempts from one IP, plaintext authentication over 143/110 (instead of the TLS ports), and mailbox access outside legitimate clients' usual pattern. Anonymous login or an abnormal volume of FETCH/RETR are also signs of mail harvesting.

Defence. Enforce TLS (disable the cleartext ports or require STARTTLS), disable anonymous login and password logging, apply attempt limits, and monitor mailbox access. Related to SMTP user enumeration, credential hunting and credential reuse.