Skip to main content
Default Ports: 143 (IMAP), 993 (IMAPS) IMAP is how a mail client reads and manages mail that stays stored on the server, rather than downloading and deleting it locally. That server-side state is exactly what makes it worth testing: valid credentials against IMAP don’t just confirm a login, they hand over the actual mailbox, every folder, every message, every attachment.

IMAP vs POP3

POP3 downloads mail and typically removes it from the server. IMAP keeps everything server-side and syncs across multiple clients, which is why it’s the far more common protocol today and the one worth prioritizing during enumeration.

IMAP vs IMAPS

Plain IMAP (143) sends credentials and mail content in cleartext unless STARTTLS is negotiated. IMAPS (993) wraps the entire session in TLS from the start.
Credentials found anywhere else on an engagement, a config file, a password spray hit, a reused password, are always worth trying against IMAP. It’s one of the most overlooked re-use targets precisely because it feels like “just email.”

​
Connecting

curl can authenticate and interact with a mailbox directly, useful for a quick credential check without dropping into a full manual session:
Listing and retrieving specific mail works the same way, just by pointing curl at the mailbox and message path:

​
Nmap Enumeration

Scanning 110 and 995 (POP3/POP3S) alongside IMAP’s ports is worth doing in the same pass, a lot of mail servers expose both protocols on the same backend, and whichever is less hardened is usually the better target.

​
Manual IMAP Commands

Every IMAP command is prefixed with a tag, typically just an incrementing number, that the server echoes back in its response so the client can match replies to requests. In a manual session you can just use 1 for every command.
CommandDescription
1 LOGIN username passwordAuthenticate
1 LIST "" *List all mailboxes/folders
1 LSUB "" *List only folders marked as subscribed
1 SELECT INBOXOpen a mailbox to access its messages
1 UNSELECT INBOXClose the currently selected mailbox
1 FETCH <ID> ALLRetrieve metadata for a specific message
1 FETCH 1 BODY[]Fetch the full content of message 1
1 CREATE "INBOX"Create a new mailbox
1 DELETE "INBOX"Delete a mailbox
1 RENAME "ToRead" "Important"Rename a mailbox
1 CLOSEPermanently remove messages flagged Deleted
1 LOGOUTEnd the session

​
Manual Enumeration Walkthrough

A typical manual session, once you’ve got valid credentials, follows the same sequence every time: connect, authenticate, see what’s there, then read it.
1

Connect

2

Authenticate

A 1 OK LOGIN completed response confirms the credentials are valid.
3

List available mailboxes

This reveals every folder the account has, worth checking beyond just the inbox, sent items and archived folders often hold more interesting content.
4

Select a mailbox and pull message IDs

1:* requests metadata for every message in the mailbox at once, rather than fetching one at a time.
5

Read specific messages

Pulls the full raw content, headers included, of message 1.

​
Brute Forcing

​
Metasploit Modules

​
Quick Reference Tools

Hackviser: IMAP

Quick-reference pentesting guide for the IMAP service.

Hacktricks: IMAP

Quick-reference pentesting guide for the IMAP service.
A successful IMAP login exposes the full contents of someone’s mailbox. Treat access to it with the same care as any other sensitive data find, confirm scope and handle what you read responsibly.