✉️ Email — SMTP (25) · IMAP (143) · POP3 (110)

SMTP sends mail · POP3 receives (multi-device sync) · IMAP receives (single device).

SMTP enumeration

nmap IP -p 25 --open            # find SMTP
nc IP 25                        # then: VRFY root    (user enumeration)
swaks --to test@ddd.com --server smtpd --attach XXX.pdf   # send a test mail

IMAP

nc IP 143                       # connect

If the mail system accepts Office macros, craft an .hta payload (payloads-shells) and use a client-side delivery (exploitation → client-side attack). swaks is also used in the phishing step there.