Read a fetched message
Practitioner 20 ptsGoal: Log in, RETR a message, and read the recovery code inside it.
Capture it yourself — real POP3 needs a terminal
- Start Wireshark on your active interface with filter
tcp.port == 2110(orsudo tcpdump -i any -w cap.pcap port 2110). - Run this against the real POP3 server on this box:
curl 'pop3://ctf.nitaimaarek.com:2110/1' --user alice:s3cret
Stop the capture and Follow → TCP Stream. curl logs in and RETRs message 1. Its body contains a one-time recovery code — that's the answer.
No nc? On Linux/macOS try ncat, or bash: exec 3<>/dev/tcp/ctf.nitaimaarek.com/2110. The exchange is plaintext, so it's fully readable in your capture — that's the whole point.
Hints
Open in order — they nudge, not solve.
Hint 1
Let curl drive it: curl 'pop3://ctf.nitaimaarek.com:2110/1' --user alice:s3cret (capture tcp.port == 2110).
Hint 2
That fetches message 1. Follow → TCP Stream to see the whole message body in the clear.
Hint 3
The body contains a one-time recovery code POP3-MAILCODE-… — that's the answer.