> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/services/110-995-pop3.md).

# 110, 995 - POP3

* [ ] **1. general checks POP3**

```bash
##### REFERENCE: https://hackviser.com/tactics/pentesting/services/pop3
# 1. nmap scan & banner grabbing
nmap -sC -sV -p 110 {{RHOST}} --script=pop3*
nc -vn {{RHOST}} 110

# 2. show the capabilities of the POP3 server
telnet {{RHOST}} 110 # plain
CAPA
```

* [ ] **2. bruteforce POP3**

```bash
### ---
# NOTE: if there is a website, extract (if applicable) users and passwords. Use that as a base for the wordlists
### ---

# 1. POP3 (plaintext)
# 1A. username + password combination
# 1B. lowercase usernames + password combination
# 1C. -e snr = try 'blank' passwords, 'n' for username = password, 'r' for reversed username
hydra -L users.txt -P /usr/share/wordlists/fasttrack.txt -e snr {{RHOST}} pop3
hydra -L <(tr A-Z a-z < users.txt) -P /usr/share/wordlists/fasttrack.txt -e snr {{RHOST}} pop3

# 2. POP3S (SSL/TLS)
hydra -L users.txt -P /usr/share/wordlists/fasttrack.txt -e snr {{RHOST}} pop3s
hydra -L <(tr A-Z a-z < users.txt) -P /usr/share/wordlists/fasttrack.txt -e snr {{RHOST}} pop3s
```

* [ ] **3. interacting with POP3**

```bash
# 1. utilizing telnet (plaintext)
telnet {{RHOST}} 110
USER <username>
PASS <password>

# 2. utilizing openssl (SSL/TLS)
openssl s_client -connect {{RHOST}}:995 -crlf -quiet

# 3. Once authenticated, use the following commands:
# List messages
LIST

# Message count and size
STAT

# Get message UIDs
UIDL

# Retrieve specific messages
RETR 1  # Retrieve first email
RETR 2  # Second email

QUIT
```