# etcd Enumeration

> Techniques for enumerating etcd key-value stores, extracting cluster data, credentials, and Kubernetes secrets via API queries and client tools.

- **URL:** https://hackindex.io/services/etcd/enumeration/etcd-enumeration
- **Path:** etcd > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/etcd/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

etcd is a distributed key-value store used primarily by Kubernetes for cluster state and configuration. It runs on port 2379 (client API) and 2380 (peer communication). Many etcd deployments lack authentication, exposing all stored keys, including Kubernetes secrets, service account tokens, and TLS certificates. Finding an open etcd instance in a Kubernetes environment often means full cluster compromise.

## Version Detection

```bash
curl -s http://$TARGET_IP:2379/version | python3 -m json.tool
# {
#   "etcdserver": "3.5.9",
#   "etcdcluster": "3.5.0"
# }
```

## Health and Membership

**Health check**

```bash
curl -s http://$TARGET_IP:2379/health | python3 -m json.tool
# {"health": "true", "reason": ""}
```

**List cluster members**

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 member list -w table
# +------------------+---------+-------+-------------------------+-------------------------+
# |        ID        | STATUS  | NAME  |       PEER ADDRS        |      CLIENT ADDRS       |
# +------------------+---------+-------+-------------------------+-------------------------+
# | 8e9e05c52164694d | started | etcd0 | http://10.10.10.50:2380 | http://10.10.10.50:2379 |
# +------------------+---------+-------+-------------------------+-------------------------+
```

## Authentication Check

Attempt to list keys. If authentication is not enabled, all keys are accessible.

```bash
etcdctl --endpoints=http://$TARGET_IP:2379 get / --prefix --keys-only --limit=20
# /registry/secrets/default/db-credentials
# /registry/secrets/kube-system/admin-token
# /registry/configmaps/default/app-config
# /registry/pods/default/web-app-7d4b5c
# /registry/serviceaccounts/default/default
```

If this returns an authentication error, the instance requires credentials. Check for certificate-based auth (`--cert`, `--key`, `--cacert` flags) or username/password auth.

## HTTP API Enumeration

Without `etcdctl` installed, use the v2 HTTP API (if enabled) or the v3 gRPC-gateway.

**v2 API: list all keys**

```bash
curl -s http://$TARGET_IP:2379/v2/keys/?recursive=true | python3 -m json.tool
```

If unauthenticated access is confirmed, continue to [etcd exploitation](https://hackindex.io/services/etcd/exploitation/etcd-unauthenticated-access) for secret extraction and cluster compromise.

## References

- [etcd: Security Model](https://etcd.io/docs/v3.5/op-guide/security/) - Official documentation on authentication and TLS configuration.
- [HackTricks: 2379 Pentesting etcd](https://hacktricks.wiki/en/network-services-pentesting/2379-pentesting-etcd.html) - etcd enumeration and exploitation reference.