110,995 - Pentesting POP
Post Office Protocol (POP) is a type of computer networking and Internet standard protocol that extracts and retrieves email from a remote mail server for access by the host machine. POP is an application layer protocol in the OSI model that provides end users the ability to fetch and receive email (from here).
The POP clients generally connect, retrieve all messages, store them on the client system, and delete them from the server. There are 3 versions of POP, but POP3 is the most used one.
Default ports: 110, 995(ssl)
PORT STATE SERVICE110/tcp open pop3
nc -nv <IP> 110openssl s_client -connect <IP>:995 -crlf -quiet
nmap --scripts "pop3-capabilities or pop3-ntlm-info" -sV -port <PORT> <IP> #All are default scripts
The pop3-ntlm-info plugin will return some "sensitive" data (Windows versions).
​POP3 bruteforce​
POP commands:​USER uid Log in as "uid"​PASS password Substitue "password" for your actual password​STAT List number of messages, total mailbox size​LIST List messages and sizes​RETR n Show message n​DELE n Mark message n for deletion​RSET Undo any changes​QUIT Logout (expunges messages if no RSET)TOP msg n Show first n lines of message number msg
From here​
Example:
root@kali:~# telnet $ip 110+OK beta POP3 server (JAMES POP3 Server 2.3.2) readyUSER billydean+OKPASS password+OK Welcome billydeanlist+OK 2 18071 7862 1021​retr 1+OK Message followsFrom: jamesbrown@motown.comDear Billy Dean,​Here is your login for remote desktop ... try not to forget it this time!username: billydeanpassword: PA$$W0RD!Z
Last updated 3 weeks ago