Port 143 (IMAP)

NMAP

sudo nmap 10.129.14.128 -sV -p110,143,993,995 -sC

CURL

Basic navigation is possible with CURL, but the documentation is light on details so checking the source is recommended for precise details.

Listing mailboxes (imap command LIST "" "*")

curl -k 'imaps://1.2.3.4/' --user user:pass

Listing messages in a mailbox (imap command SELECT INBOX and then SEARCH ALL)

curl -k 'imaps://1.2.3.4/INBOX?ALL' --user user:pass

The result of this search is a list of message indicies.

Its also possible to provide more complex search terms. e.g. searching for drafts with password in mail body:

curl -k 'imaps://1.2.3.4/Drafts?TEXT password' --user user:pass

Downloading a message (imap command SELECT Drafts and then FETCH 1 BODY[])

curl -k 'imaps://1.2.3.4/Drafts;MAILINDEX=1' --user user:pass

The mail index will be the same index returned from the search operation.

It is also possible to use UID (unique id) to access messages, however it is less conveniant as the search command needs to be manually formatted. E.g.

curl -k 'imaps://1.2.3.4/INBOX' -X 'UID SEARCH ALL' --user user:pass 
curl -k 'imaps://1.2.3.4/INBOX;UID=1' --user user:pass

TLS Encrypted Interaction

POP3

To interact with the IMAP or POP3 server over SSL, we can use openssl, as well as ncat. The commands for this would look like this:

openssl s_client -connect <IP>:pop3s

IMAPS

openssl s_client -connect 10.129.14.128:imaps