> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-6/credentials/mail-spool/trick-0209.md). # Extract Credentials from POP3 Email *** Access a compromised POP3 account directly using netcat to retrieve emails. These emails can contain credentials or other sensitive information for pivoting. A POP3 server typically listens on TCP port 110 for service requests. Connect to the POP3 server on port 110: ```bash nc 110 ``` Upon successful connection, the server should respond with a positive status indicator, often starting with `+OK`. Then, interact with the server by issuing commands, terminated by a carriage return and a line feed. Commands are case-insensitive. Authenticate using the `USER` and `PASS` commands: ```pop3 USER ``` The server will respond, typically `+OK User ok, send password.` or similar if the user is recognized. Then provide the password: ```pop3 PASS ``` If the user is valid and the password matches, the POP3 server enters the TRANSACTION state, usually indicated by a response like `+OK Mailbox open, ... messages`. If the user or password information is invalid, the server replies with a negative status indicator, starting with `-ERR`. Once authenticated, you can obtain information about the mailbox and retrieve messages. To obtain the current status of the maildrop, including the number of messages and total size, use the `STAT` command: ```pop3 STAT ``` The response is a single line beginning with `+OK` followed by two numbers separated by a space. The first number is the number of messages in the maildrop, and the second number is the size of the maildrop in octets. For example: ``` +OK 2 1000 ``` To list all messages with their sizes: ```pop3 LIST ``` The server responds with `+OK Mailbox scan listing follows`, followed by lines each containing a message number and its size in octets, ending with a single period (`.`) on a line by itself. For example: ``` +OK Mailbox scan listing follows 1 1234 2 567 . ``` To retrieve a specific message, use the `RETR` command followed by the message number: ```pop3 RETR ``` If the message exists, the server issues a positive response, listing the message number and its size (`+OK octets`). The response is multi-line and consists of the message being retrieved, ending with a single period (`.`) on a line by itself. This command also causes the message to be marked as deleted on the server. To mark a message for deletion, use the `DELE` command followed by the message number: ```pop3 DELE ``` The response is `+OK` if the message was successfully marked, or `-ERR` if not. Messages marked for deletion are not actually removed from the server until the session enters the UPDATE state (typically upon issuing the `QUIT` command). To unmark any messages previously marked for deletion in the current session, use the `RSET` command: ```pop3 RSET ``` The response is always `+OK`. Analyze the retrieved message content for credentials or other leads. When finished, issue the `QUIT` command: ```pop3 QUIT ``` The POP3 server removes all messages marked as deleted from the mailbox, updates the state, and then terminates the connection, typically responding with `+OK Pop server signing off`. If no messages were marked as deleted, the server makes no changes to the mailbox before closing the connection.