Skip to main content
Default Ports: 110 (POP3), 995 (POP3S) POP3 is the older, simpler counterpart to IMAP: a client logs in, downloads whatever mail is waiting, and typically deletes it from the server afterward. That simplicity means less to enumerate than IMAP, no folder structure to browse, but a valid login still hands over everything sitting in the mailbox at that moment.
POP3 and IMAP often run on the same mail server, sometimes even sharing the same backend mailstore. If credentials work against one, they’re worth trying against the other too. See the 143 & 993 - IMAP (Internet Message Access Protocol) for the folder-based protocol this one gets compared against most.
Plain POP3 (110) sends the USER and PASS commands in cleartext unless STLS is negotiated. Prefer 995 (POP3S) whenever it’s available, both for operational safety and because it’s simply more likely to be the properly configured endpoint.

​
Connecting

​
Nmap Enumeration

Scanning IMAP’s ports (143, 993) in the same pass is worth doing, since a server offering both protocols often has one configured more loosely than the other.

​
Manual POP3 Commands

Unlike IMAP’s tagged, numbered command style, POP3’s command set is small and untagged, each command gets a direct +OK or -ERR response.
CommandDescription
USER usernameIdentifies the user
PASS passwordAuthenticates with the password
STATReturns the number of stored messages and total mailbox size
LISTLists every message with its size
RETR <id>Retrieves a specific message by ID
DELE <id>Marks a specific message for deletion
CAPALists the server’s supported capabilities
RSETResets the session, undoing any pending deletions
QUITCloses the connection (and commits any pending deletions)

​
Manual Enumeration Walkthrough

1

Authenticate

A +OK response after PASS confirms the credentials are valid.
2

Check what's in the mailbox

STAT gives a quick count and total size; LIST breaks it down message by message, useful for deciding what’s worth pulling before retrieving everything.
3

Retrieve messages

Returns the full raw content of message 1, headers and body included.
4

Close out

Any messages marked with DELE during the session are permanently removed once you QUIT. If you only need to read mail, avoid DELE entirely, or send RSET before quitting to undo any pending deletions.

​
Brute Forcing

​
Metasploit Modules

​
Quick Reference Tools

Hackviser: POP3

Quick-reference pentesting guide for the POP3 service.

HackTricks: POP3

Deeper breakdown of POP3 enumeration and attack techniques.
DELE permanently removes mail once the session closes with QUIT. Be deliberate about which commands you send, especially against a mailbox that isn’t yours to clear out.