> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # 143 & 993 - IMAP (Internet Message Access Protocol) `Default Ports: 143 (IMAP), 993 (IMAPS)` IMAP is how a mail client reads and manages mail that stays stored on the server, rather than downloading and deleting it locally. That server-side state is exactly what makes it worth testing: valid credentials against IMAP don't just confirm a login, they hand over the actual mailbox, every folder, every message, every attachment. > **IMAP vs POP3** > > POP3 downloads mail and typically removes it from the server. IMAP keeps everything server-side and syncs across multiple clients, which is why it's the far more common protocol today and the one worth prioritizing during enumeration. > **IMAP vs IMAPS** > > Plain IMAP (143) sends credentials and mail content in cleartext unless `STARTTLS` is negotiated. IMAPS (993) wraps the entire session in TLS from the start. > [!TIP] > > Credentials found anywhere else on an engagement, a config file, a password spray hit, a reused password, are always worth trying against IMAP. It's one of the most overlooked re-use targets precisely because it feels like "just email." *** ## Connecting ```bash theme={null} openssl s_client -connect TARGET:imaps # connect directly to the TLS-wrapped IMAPS port telnet TARGET 143 # plain IMAP, no encryption, useful for manual testing ``` `curl` can authenticate and interact with a mailbox directly, useful for a quick credential check without dropping into a full manual session: ```bash theme={null} curl -k 'imaps://TARGET' --user USER:PASSWORD ``` Listing and retrieving specific mail works the same way, just by pointing `curl` at the mailbox and message path: ```bash theme={null} curl -k 'imaps://TARGET/INBOX' --user USER:PASSWORD # list messages in INBOX curl -k 'imaps://TARGET/INBOX;UID=1' --user USER:PASSWORD # fetch a specific message by UID ``` *** ## Nmap Enumeration ```bash theme={null} sudo nmap TARGET -sV -sC -p110,143,993,995 nmap TARGET -p143,993 --script "imap-*" ``` > [!TIP] > > Scanning 110 and 995 (POP3/POP3S) alongside IMAP's ports is worth doing in the same pass, a lot of mail servers expose both protocols on the same backend, and whichever is less hardened is usually the better target. *** ## Manual IMAP Commands Every IMAP command is prefixed with a tag, typically just an incrementing number, that the server echoes back in its response so the client can match replies to requests. In a manual session you can just use `1` for every command.
Command Description
`1 LOGIN username password` Authenticate
`1 LIST "" *` List all mailboxes/folders
`1 LSUB "" *` List only folders marked as subscribed
`1 SELECT INBOX` Open a mailbox to access its messages
`1 UNSELECT INBOX` Close the currently selected mailbox
`1 FETCH ALL` Retrieve metadata for a specific message
`1 FETCH 1 BODY[]` Fetch the full content of message 1
`1 CREATE "INBOX"` Create a new mailbox
`1 DELETE "INBOX"` Delete a mailbox
`1 RENAME "ToRead" "Important"` Rename a mailbox
`1 CLOSE` Permanently remove messages flagged `Deleted`
`1 LOGOUT` End the session
*** ## Manual Enumeration Walkthrough A typical manual session, once you've got valid credentials, follows the same sequence every time: connect, authenticate, see what's there, then read it. **1. Connect** ```bash theme={null} openssl s_client -connect TARGET:imaps ``` **2. Authenticate** ```text theme={null} 1 LOGIN username password ``` A `1 OK LOGIN completed` response confirms the credentials are valid. **3. List available mailboxes** ```text theme={null} 1 LIST "" * ``` This reveals every folder the account has, worth checking beyond just the inbox, sent items and archived folders often hold more interesting content. **4. Select a mailbox and pull message IDs** ```text theme={null} 1 SELECT INBOX 1 FETCH 1:* ALL ``` `1:*` requests metadata for every message in the mailbox at once, rather than fetching one at a time. **5. Read specific messages** ```text theme={null} 1 FETCH 1 BODY[] ``` Pulls the full raw content, headers included, of message 1. *** ## Brute Forcing ```bash theme={null} hydra -L users.txt -P passwords.txt TARGET imap hydra -L users.txt -P passwords.txt -S TARGET imap -s 993 # against IMAPS specifically ``` *** ## Metasploit Modules ```bash theme={null} search name:imap # list every IMAP-related module use auxiliary/scanner/imap/imap_version # fingerprint the IMAP server and version use auxiliary/scanner/imap/imap_login # brute-force IMAP credentials directly from msfconsole ``` *** ## Quick Reference Tools > **[Hackviser: IMAP](https://hackviser.com/tactics/pentesting/services/imap)** > > Quick-reference pentesting guide for the IMAP service. > **[Hacktricks: IMAP](https://hacktricks.wiki/en/network-services-pentesting/pentesting-imap.html)** > > Quick-reference pentesting guide for the IMAP service. > [!WARNING] > > A successful IMAP login exposes the full contents of someone's mailbox. Treat access to it with the same care as any other sensitive data find, confirm scope and handle what you read responsibly. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.