IMAP / POP3 - 143,993,110,995
With the help of the Internet Message Access Protocol (IMAP), access to emails from a mail server is possible. Unlike the Post Office Protocol (POP3), IMAP allows online management of emails directly on the server and supports folder structures. Here is the general difference between SMTP and IMAP:
SMTP is used for sending emails from a client to a server or between servers. It is a "push" protocol, primarily handling outgoing mail and relaying it to the recipient’s server.
IMAP is used for retrieving and managing emails from a mail server, allowing clients to view and organize messages. It is a "pull" protocol, supporting features like keeping emails on the server and synchronizing across devices.
IMAP is client-server-based and allows synchronization of a local email client with the mailbox on the server, providing a kind of network file system for emails, allowing problem-free synchronization across several independent clients. POP3, on the other hand, does not have the same functionality as IMAP, and it only provides listing, retrieving, and deleting emails as functions at the email server. Therefore, protocols such as IMAP must be used for additional functionalities such as hierarchical mailboxes directly at the mail server, access to multiple mailboxes during a session, and preselection of emails.
The client establishes the connection to the server via port 143. For communication, it uses text-based commands in ASCII format. Without further measures, IMAP works unencrypted and transmits commands, emails, or usernames and passwords in plain text. Many email servers require establishing an encrypted IMAP session to ensure greater security in email traffic and prevent unauthorized access to mailboxes. SSL/TLS is usually used for this purpose. Depending on the method and implementation used, the encrypted connection uses the standard port 143 or an alternative port such as port 993.
Default Configuration
Going into the details of both protocols configurations can be difficult as it is very large. I installed dovecot-imapd, and dovecot-pop3d to play around and experiment. In the documentation of Dovecot, we can find the individual core settings and service configuration options that can be utilized for our experiments.
Lets first look at the commands that we can use with IMAP and POP3.
IMAP
Note: append a1,a2.... an before every command.
LOGIN username password
User's login.
LIST "" *
Lists all directories.
CREATE "INBOX"
Creates a mailbox with a specified name.
DELETE "INBOX"
Deletes a mailbox.
RENAME "ToRead" "Important"
Renames a mailbox.
LSUB "" *
Returns a subset of names from the set of names that the User has declared as being active or subscribed.
SELECT INBOX
Selects a mailbox so that messages in the mailbox can be accessed.
UNSELECT INBOX
Exits the selected mailbox.
FETCH <ID> all
Retrieves data associated with a message in the mailbox.
FETCH <ID> BODY[]
Read the content of email <ID> body.
CLOSE
Removes all messages with the Deleted flag set.
LOGOUT
Closes the connection with the IMAP server.
POP3
USER username
Identifies the user.
PASS password
Authentication of the user using its password.
STAT
Requests the number of saved emails from the server.
LIST
Requests from the server the number and size of all emails.
RETR id
Requests the server to deliver the requested email by ID.
DELE id
Requests the server to delete the requested email by ID.
CAPA
Requests the server to display the server capabilities.
RSET
Requests the server to reset the transmitted information.
QUIT
Closes the connection with the POP3 server.
Dangerous Settings
Many configuration mistakes can be made by administrators, which in the worst cases will allow us to read all the emails sent and received, which may even contain confidential or sensitive information. Some of these configuration options include:
auth_debug
Enables all authentication debug logging.
auth_debug_passwords
This setting adjusts log verbosity, the submitted passwords, and the scheme gets logged.
auth_verbose
Logs unsuccessful authentication attempts and their reasons.
auth_verbose_passwords
Passwords used for authentication are logged and can also be truncated.
auth_anonymous_username
This specifies the username to be used when logging in with the ANONYMOUS SASL mechanism.
Footprinting IMAP/POP3
By default, ports 110 and 995 are used for POP3, and ports 143 and 993 are used for IMAP. The higher ports (993 and 995) use TLS/SSL to encrypt the communication between the client and server. Using Nmap, we can scan the server for these ports. The scan will return the corresponding information (as seen below) if the server uses an embedded certificate.
cURL
If we also use the verbose (-v) option, we will see how the connection is made. From this, we can see the version of TLS used for encryption, further details of the SSL certificate, and even the banner, which will often contain the version of the mail server.
To interact with the IMAP or POP3 server over SSL, we can use openssl, as well as ncat. The commands for this would look like this:
Last updated