> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 110 & 995 - POP3 (Post Office Protocol)

`Default Ports: 110 (POP3), 995 (POP3S)`

POP3 is the older, simpler counterpart to IMAP: a client logs in, downloads whatever mail is waiting, and typically deletes it from the server afterward. That simplicity means less to enumerate than IMAP, no folder structure to browse, but a valid login still hands over everything sitting in the mailbox at that moment.

> [!NOTE]
>
> POP3 and IMAP often run on the same mail server, sometimes even sharing the same backend mailstore. If credentials work against one, they're worth trying against the other too. See the [143 & 993 - IMAP (Internet Message Access Protocol)](https://0-x.dev/untitled-page-8) for the folder-based protocol this one gets compared against most.

> [!TIP]
>
> Plain POP3 (110) sends the `USER` and `PASS` commands in cleartext unless `STLS` is negotiated. Prefer 995 (POP3S) whenever it's available, both for operational safety and because it's simply more likely to be the properly configured endpoint.

***

## Connecting

```bash theme={null}
openssl s_client -connect TARGET:pop3s      # connect directly to the TLS-wrapped POP3S port
telnet TARGET 110                             # plain POP3, no encryption, fine for manual testing
```

***

## Nmap Enumeration

```bash theme={null}
sudo nmap TARGET -sV -sC -p110,143,993,995
nmap TARGET -p110,995 --script "pop3-*"
```

> [!TIP]
>
> Scanning IMAP's ports (143, 993) in the same pass is worth doing, since a server offering both protocols often has one configured more loosely than the other.

***

## Manual POP3 Commands

Unlike IMAP's tagged, numbered command style, POP3's command set is small and untagged, each command gets a direct `+OK` or `-ERR` response.

<table>
  <colgroup>
    <col width="135" />

    <col width="536" />
  </colgroup>

  <thead>
    <tr>
      <th>Command</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`USER username`</td>
      <td>Identifies the user</td>
    </tr>

    <tr>
      <td>`PASS password`</td>
      <td>Authenticates with the password</td>
    </tr>

    <tr>
      <td>`STAT`</td>
      <td>Returns the number of stored messages and total mailbox size</td>
    </tr>

    <tr>
      <td>`LIST`</td>
      <td>Lists every message with its size</td>
    </tr>

    <tr>
      <td>`RETR <id>`</td>
      <td>Retrieves a specific message by ID</td>
    </tr>

    <tr>
      <td>`DELE <id>`</td>
      <td>Marks a specific message for deletion</td>
    </tr>

    <tr>
      <td>`CAPA`</td>
      <td>Lists the server's supported capabilities</td>
    </tr>

    <tr>
      <td>`RSET`</td>
      <td>Resets the session, undoing any pending deletions</td>
    </tr>

    <tr>
      <td>`QUIT`</td>
      <td>Closes the connection (and commits any pending deletions)</td>
    </tr>
  </tbody>
</table>

***

## Manual Enumeration Walkthrough

```bash theme={null}
openssl s_client -connect TARGET:pop3s
```

**1. Authenticate**

```text theme={null}
USER username
PASS password
```

A `+OK` response after `PASS` confirms the credentials are valid.

**2. Check what's in the mailbox**

```text theme={null}
STAT
LIST
```

`STAT` gives a quick count and total size; `LIST` breaks it down message by message, useful for deciding what's worth pulling before retrieving everything.

**3. Retrieve messages**

```text theme={null}
RETR 1
```

Returns the full raw content of message 1, headers and body included.

**4. Close out**

```text theme={null}
QUIT
```

> [!WARNING]
>
> Any messages marked with `DELE` during the session are permanently removed once you `QUIT`. If you only need to read mail, avoid `DELE` entirely, or send `RSET` before quitting to undo any pending deletions.

***

## Brute Forcing

```bash theme={null}
hydra -L users.txt -P passwords.txt pop3://TARGET
hydra -L users.txt -P passwords.txt -S pop3://TARGET:995     # against POP3S specifically
```

***

## Metasploit Modules

```bash theme={null}
search name:pop3                                  # list every POP3-related module
use auxiliary/scanner/pop3/pop3_version              # fingerprint the POP3 server and version
use auxiliary/scanner/pop3/pop3_login                  # brute-force POP3 credentials directly from msfconsole
```

***

## Quick Reference Tools

> **[Hackviser: POP3](https://hackviser.com/tactics/pentesting/services/pop3)**
>
> Quick-reference pentesting guide for the POP3 service.

> **[HackTricks: POP3](https://hacktricks.wiki/en/network-services-pentesting/pentesting-pop.html)**
>
> Deeper breakdown of POP3 enumeration and attack techniques.

> [!WARNING]
>
> `DELE` permanently removes mail once the session closes with `QUIT`. Be deliberate about which commands you send, especially against a mailbox that isn't yours to clear out.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.