What tool you can recommend to reveal credentials transferred in unencrypted connection to POP3 server?

  • I would prefer free and possibly open-source solutions.
  • Platforms are Linux and/or Windows.

You can use tcpdump:

  • free and open-source
  • works on Linux
  • can sniff network data, such as POP3 passwords:

Code snippet to get POP3 passwords and a bit more:

tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20`
  • 1
    I'm awarding this answer because of open character of packet capturing. There is also command-line compatible WinPCap equivalent of the tool for Windows users. – miroxlav Apr 20 '14 at 11:08

You can use Wireshark:

  • free and open-source
  • works on Windows/Linux/Mac
  • can capture all network data. Just filter what you need:

enter image description here


You can use dsniff:

  • free and open-source
  • works on Linux
  • can sniff network data, such as POP3 password: dsniff -i any 'tcp port pop3'

Sample output:

dsniff: listening on any [tcp port pop3]
11/18/10 10:41:01 tcp xxx.48323 -> remote.host.110 (pop3)
USER user1
PASS pass-for-user1

11/18/10 10:41:28 tcp xxx.48321 -> other.host.110 (pop3)
USER user2
PASS pass-for-user2

I'd use ngrep. It's more or less tcpdump and grep rolled into one tool. You can use the same match conditions (verbatim) as in Franck Dernoncourt's answer, but you don't have to pipe between tools, and having the regular expression match on a per-packet-content basis rather than per-line as in grep is nicer.

ngrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' port http or port ftp or port smtp or port imap or port pop3
  • features look very useful and as far I can see, it is also available for Windows. – miroxlav Apr 20 '14 at 13:47

You can use SniffPass:

  • free but not open-source
  • works on Windows 98/ME/NT/2000/XP/2003/Vista/7
  • NirSoft quality
  • can capture the passwords of the following Protocols: POP3, IMAP4, SMTP, FTP, and HTTP (basic authentication passwords).

enter image description here

  • very good tool for someone who doesn't want to go too technical way – miroxlav Apr 20 '14 at 16:07
  • @miroxlav yes probably the easiest to use! – Franck Dernoncourt Apr 20 '14 at 16:12

Just one more note with this.

Normal USER/PASS is sent in clear text so you can see it in packet captures, but POP3 has an extension mechanism and a number of alternative authentication mechanisms, which may or may not be visible.

SASL LOGIN, for example is clear text but Base64 encoded, so you could retrieve the passwords with a Base64 decoder.

However, it's also common to use hash-based authentication such as CRAM-MD5, APOP, or NTLM, or even GSSAPI (Kerberos).

Most modern POP3 clients support secure authentication, and so do many mail servers. So your luck with a packet capturing approach may vary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.