> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/services/110-pop3.md).
# (110) POP3
Nmap Scan
```bash
nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -port
```
* May return some "**sensitive**" data (Windows versions).
Enumerate Emails in POP3 server
* POP provides end users the ability to fetch and receive email
```bash
telnet 10.11.1.72 110
```
```
USER ryuu
```
```
PASS password
```
```
LIST
```
```
RETR 1
```
```
RETR 2
```
Always check for credentials in dovecot for mail servers
Check the file:
```bash
/etc/dovecot/dovecot-users
```