110,995 - Pentesting POP
Post Office Protocol (POP) is a type of computer networking and Internet standard protocol that extracts and retrieves email from a remote mail server for access by the host machine. POP is an application layer protocol in the OSI model that provides end users the ability to fetch and receive email (from here).
The POP clients generally connect, retrieve all messages, store them on the client system, and delete them from the server. There are 3 versions of POP, but POP3 is the most used one.
Default ports: 110, 995(ssl)
PORT STATE SERVICE110/tcp open pop3
nc -nv <IP> 110openssl s_client -connect <IP>:995 -crlf -quiet
You can use the command CAPA to obtain the capabilities of the POP3 server.
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -port <PORT> <IP> #All are default scripts
The pop3-ntlm-info plugin will return some "sensitive" data (Windows versions).
​POP3 bruteforce​
POP commands:USER uid Log in as "uid"PASS password Substitue "password" for your actual passwordSTAT List number of messages, total mailbox sizeLIST List messages and sizesRETR n Show message nDELE n Mark message n for deletionRSET Undo any changesQUIT Logout (expunges messages if no RSET)TOP msg n Show first n lines of message number msgCAPA Get capabilities
From here​
Example:
[email protected]:~# telnet $ip 110+OK beta POP3 server (JAMES POP3 Server 2.3.2) readyUSER billydean+OKPASS password+OK Welcome billydean​list​+OK 2 18071 7862 1021​retr 1​+OK Message followsFrom: [email protected]Dear Billy Dean,​Here is your login for remote desktop ... try not to forget it this time!username: billydeanpassword: PA$$W0RD!Z
Last updated 2 weeks ago